https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-03T15:27:55.859950+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/ghsa-4vrq-3vrq-g6gg GHSA-4vrq-3vrq-g6gg — BuildKit Git URL subdir component can cause access to restricted files 2026-10-03T15:27:55.870439+00:00

Affected: Go: github.com/moby/buildkit

### Impact Insufficient validation of Git URL fragment subdir components (`<url>#<ref>:<subdir>`, [docs](https://docs.docker.com/build/concepts/context/#url-fragments)) may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem.

### Patches The issue has been fixed in version v0.28.1

### Workarounds The issue affects only builds that use Git URLs with a subpath component. Avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.