CVE-2026-44517

A flaw was found in Buildah. Insecure handling of temporary directories and symlinks during the image build process, specifically within TempDirForURL, downloadToDirectory, and stdinToDirectory functions, allows a malicious server supplying a Git repository or tar archive to cause files outside the build context directory to be included or copied into the build. This could lead to a build breakout, enabling an attacker to manipulate files on the host system.

Red Hat ships Buildah as a standalone package and as a bundled dependency in Podman across RHEL, OpenShift, and RHIVOS. Versions of Buildah from 1.38.1 through 1.43.1 are affected. Older streams (RHEL 8.x, RHEL 9.2, RHEL 9.4, OpenShift 4.12–4.18) ship Buildah versions below 1.38.1 and are not affected. RHEL 9.9 and RHEL 10.3 already ship the fixed version (1.43.2 and 1.45.0 respectively).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.