GO-2026-5116 Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah

Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation...

Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive

Impact When processing a build contexts or add/copy instructions, a malicious server serving a Git repository or a tar archive file can cause files outside of the build context directory to be included in the build context or copied into the build. Patches Fixed in Buildah 1.44 and 1.43.2...