This vulnerability (CWE-22) in moby BuildKit involves improper limitation of a pathname to a restricted directory, allowing a client with valid permissions on the BuildKit control API to upload files that escape the intended BuildKit state directory. The issue arises from insufficient validation of upload request paths, enabling path traversal attacks. Exploitation requires the attacker to have legitimate access to the BuildKit API, such as through bypassing authentication or possessing appropriate privileges. No official remediation or patch information is currently available, and no known exploits in the wild have been reported.

An attacker with limited privileges to the BuildKit control API can leverage this vulnerability to write files outside the designated BuildKit state directory. This could lead to unauthorized file creation or modification on the host system, potentially impacting system integrity or enabling further attacks depending on the environment and file locations affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the BuildKit control API to trusted users only and monitor for unauthorized API usage. Avoid exposing BuildKit APIs to untrusted networks or users.