CVE-2026-44517: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in containers buildah

Buildah versions >=1.38.1 and <1.43.2, as well as versions >=1.44.0 and <1.44.0, contain a path traversal vulnerability (CWE-22) in the TempDirForURL function and related code. The vulnerability arises because the tool does not securely restrict Git repository subdirectories or handle Dockerfile symlinks from partially extracted tar archives, allowing files outside the build context to be included. This can be exploited by a malicious server supplying crafted Git repositories or tar archives. The issue is resolved in versions 1.43.2 and 1.44.0.

An attacker controlling a Git repository or tar archive server can cause Buildah to include or copy files outside the intended build context directory during image builds. This can lead to unauthorized disclosure of files with high confidentiality impact. The CVSS 3.1 score is 6.3 (medium severity), reflecting local attack vector with low complexity, no privileges required, user interaction required, and high confidentiality impact but no integrity or availability impact.

Upgrade Buildah to version 1.43.2 or later, or 1.44.0 or later, where this path traversal vulnerability is fixed. No other mitigations are indicated by the vendor advisory. Patch status is confirmed fixed in these versions.