https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 15:27:55 +0000 https://db.gcve.eu/vuln/ghsa-4vrq-3vrq-g6gg <p><strong>Affected:</strong> Go: github.com/moby/buildkit</p> <p>### Impact Insufficient validation of Git URL fragment subdir components (`&lt;url&gt;#&lt;ref&gt;:&lt;subdir&gt;`, [docs](https://docs.docker.com/build/concepts/context/#url-fragments)) may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem.</p> <p>### Patches The issue has been fixed in version v0.28.1</p> <p>### Workarounds The issue affects only builds that use Git URLs with a subpath component. Avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.</p> <p><strong>Affected:</strong> Go: github.com/moby/buildkit</p> <p>### Impact Insufficient validation of Git URL fragment subdir components (`&lt;url&gt;#&lt;ref&gt;:&lt;subdir&gt;`, [docs](https://docs.docker.com/build/concepts/context/#url-fragments)) may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem.</p> <p>### Patches The issue has been fixed in version v0.28.1</p> <p>### Workarounds The issue affects only builds that use Git URLs with a subpath component. Avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.</p> https://db.gcve.eu/vuln/ghsa-4vrq-3vrq-g6gg