BuildKit allows the use of custom frontends that can send API messages to the build daemon. A malicious frontend can construct a message that causes files to be written outside the build state directory, effectively escaping the intended filesystem boundary. This flaw, classified as a file path traversal, can lead to arbitrary file writes and, depending on the content written, may enable remote code execution or privilege escalation. The CVSS score of 8.4 reflects the high severity of this improper access control weakness.

The vulnerability affects BuildKit releases from moby prior to version 0.28.1. Any instance that accepts custom frontends via the #syntax directive or the BUILDKIT_SYNTAX build argument is susceptible, while well‑known, trusted frontends such as docker/dockerfile are not impacted. All builds executed with an untrusted custom frontend run in the affected versions are at risk.

The lack of an EPSS score and absence from the CISA KEV catalog do not diminish the risk; the flaw can be exploited by anyone who can inject or dictate a custom frontend into a BuildKit‑enabled build environment. The CVSS rating of 8.4 indicates a high likelihood of successful exploitation if the attacker can leverage the vulnerable frontend. Monitoring of build configurations and controlling frontend sources are recommended until the issue is patched.