Path Traversal in Moby Buildkit
CVE-2026-15791
A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp direc…
Vulnerability class: Path Traversal (Directory Traversal)
Affected products
- Moby Buildkit — versions 0.10.0
Weakness classification (CWE)
References
- security@docker.com (vendor-advisory)