A BuildKit client can create an upload request that bypasses the destination directory validation inside the BuildKit daemon, allowing files to be written outside the controlled state directory. This flaw permits arbitrary host file creation or modification, compromising confidentiality, integrity, and availability if the attacker is able to write critical configuration files or place malicious binaries. The weakness is a classic path traversal / directory traversal flaw, identified with CWE-22.

All BuildKit installations provided by the moby vendor that run a version earlier than 0.31.2 are affected. The vulnerability is tied to any BuildKit instance that has not applied the 0.31.2 or newer fix, regardless of deployment environment.

The CVSS score of 7.2 indicates a high‑impact vulnerability. The EPSS score is not available and the issue is not listed in CISA KEV. Exploitation requires valid permissions to the BuildKit control API, which can be obtained through an authentication bypass or by exposing the API to untrusted clients. The likely attack vector is an attacker who has established a legitimate, but malicious, BuildKit client capable of communicating with the daemon’s control interface, enabling the upload of files that escape the intended directory.