{"schema_version":"1.3.1","id":"GO-2026-5116","modified":"2026-07-27T15:30:50Z","published":"2026-07-27T15:30:50Z","aliases":["CVE-2026-44517","GHSA-49p4-px3h-rq49"],"summary":"Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah","details":"Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation.","affected":[{"package":{"name":"github.com/containers/buildah","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.38.1"}]}],"ecosystem_specific":{}}],"references":[{"type":"ADVISORY","url":"https://github.com/containers/buildah/security/advisories/GHSA-49p4-px3h-rq49"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-5116","review_status":"REVIEWED"}}