The vulnerability allows an attacker to cause a BuildKit frontend to write files outside the intended state directory by sending a crafted API message. This provides the ability to overwrite or create files in arbitrary locations, potentially enabling privilege escalation or system compromise. The weakness is classified as CWE-22: Path Traversal. The severity is CVSS 8.4, indicating a high likelihood of impact if exploited.

The affected product is BuildKit from the Moby project, versions prior to 0.28.1. Any installation that relies on custom frontends specified with #syntax or --build-arg BUILDKIT_SYNTAX is susceptible. Using the well‑known dockerfile frontend does not trigger the flaw.

The flaw was fixed in BuildKit v0.28.1, so upgrading eliminates the risk. Exploitation requires an untrusted frontend configuration, meaning the attack vector is through build scripts that pull malicious frontends. The EPSS score is below 1%, suggesting low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, systems running vulnerable versions should be patched promptly.