Summary
It was discovered that BuildKit, contained within Docker, incorrectly
handled file path validation when processing frontend API messages. An
attacker could possibly use this issue to write files outside of the
intended state directory. (CVE-2026-33747)
It was discovered that BuildKit, contained within Docker, incorrectly
validated the subdir component of Git URL fragments. An attacker could
possibly use this issue to access files outside of the checked-out
repository root. (CVE-2026-33748)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | docker.io-app | 29.1.3-0ubuntu3~22.04.2 |
| Ubuntu · 24.04 LTS 24.04:LTS | docker.io-app | 29.1.3-0ubuntu3~24.04.2 |
| Ubuntu · 26.04 LTS 26.04:LTS | docker.io-app | 29.1.3-0ubuntu4.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | docker.io-app | 26.1.3-0ubuntu1~20.04.1+esm2 |