In Docker Buildx v0.19.0 through v0.38.0, untrusted Bake definitions can expose files to the Buildx client when the file names start with the current working directory’s basename. This bypasses the expected filesystem entitlement check and allows an attacker to read files that should remain protected. The effect is a data disclosure vulnerability within the Buildx build process.

This issue affects Docker Buildx users running versions 0.19.0 to 0.38.0. Upgrading to version 0.38.1 or later eliminates the vulnerability.

The CVSS score of 1.8 indicates low impact, and the EPSS score is not available, suggesting limited exploitation probability. The vulnerability is not listed in CISA KEV. Exploitation requires an attacker to supply a specially crafted Bake definition with a local filename that shares the current directory’s basename as a prefix, and the definition must be trusted or indirectly executed. Under these conditions, an attacker could read sensitive files in the build context.