CVE-2026-33748: BuildKit Git URL subdir component can cause access to restricted files

March 26, 2026 (updated April 24, 2026)

Insufficient validation of Git URL fragment subdir components (<url>#<ref>:<subdir>, docs) may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem.

References

docs.docker.com/build/concepts/context/
github.com/advisories/GHSA-4vrq-3vrq-g6gg
github.com/moby/buildkit/releases/tag/v0.28.1
github.com/moby/buildkit/security/advisories/GHSA-4vrq-3vrq-g6gg
nvd.nist.gov/vuln/detail/CVE-2026-33748

Code Behaviors & Features

Detect and mitigate CVE-2026-33748 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →