CVE-2026-33748

CVE-2026-33748 is a high-severity path traversal vulnerability affecting BuildKit versions prior to 0.28.1, where insufficient validation of Git URL fragment subdir components allows access to files outside the checked-out repository root on the same mounted filesystem. With a CVSS v4.0 score of 8.2 (High), this vulnerability has a network attack vector and low attack complexity, potentially leading to high confidentiality impact by exposing sensitive data. Although fixed in version 0.28.1 and workarounds are available, there is currently no evidence of active exploitation, public exploit code, or significant community discussion, as indicated by its very low EPSS score.