A custom client can construct an upload request to the BuildKit daemon that bypasses destination directory validation, enabling files to be written outside the intended state directory. The flaw permits arbitrary file placement, which could lead to unauthorized disclosure, tampering with the build environment, or execution of malicious code within the daemon’s context. This weakness is a directory traversal flaw (CWE‑22). The likely attack vector requires the attacker to possess valid permissions to the BuildKit control API or to bypass authentication mechanisms, as the client must authenticate to issue builds.

Moby’s BuildKit is affected when it accepts uploads from non‑standard clients; any instance that allows builds from external parties without strict client validation is potentially impacted. No specific version information is provided, so the risk applies broadly to BuildKit deployments that accept such uploads.

The CVSS score of 6.9 indicates a medium severity flaw, while the EPSS score of below 1 % shows an extremely low expected exploitation probability at present. The issue is not listed in the CISA KEV catalog. Exploitation requires access to the BuildKit control API, meaning the attacker must either hold legitimate credentials or bypass authentication mechanisms. Because the flaw allows arbitrary file placement, successful exploitation would grant the attacker significant compromise potential for the BuildKit service and downstream systems interacting with its state directories.