A crafted message to the BuildKit low‑level build API can cause the host's /tmp directory contents to be deleted. The vulnerability exploits path traversal (CWE‑22), letting an attacker delete temporary files that are not part of the build container. Deleting these files can lead to loss of data, interruption of cleanup processes, and potential breaching of script execution that relies on temporary files, thereby causing a denial of service or other unintended behavior on the host.

The affected product is Moby BuildKit, as identified by the CNA vendor. No specific version information is provided in the advisory, so all current releases are potentially vulnerable unless a later patch removes the issue.

The CVSS score of 3.3 indicates low severity, and the EPSS score of less than 1% shows a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, further indicating that widespread exploitation is not currently documented. Based on the description, it is inferred that exploitation requires sending a crafted LLB message to the BuildKit low‑level API, which is not normally exposed during standard Dockerfile builds. The reported workaround suggests that the issue is confined to the low‑level API and cannot be reached by standard Dockerfile operations, reducing the practical risk to environments that do not expose or use the low‑level interface.