CVE-2026-15791— LLB file operation can be tricked to remove /tmp directory contents
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-15791
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
LLB file operation can be tricked to remove /tmp directory contents
Source: NVD (National Vulnerability Database)
Vulnerability Description
A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-15791
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-15791
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-15791 (1)
Same Patch Batch · moby · 2026-07-21 · 4 CVEs total
| CVE-2026-15792 | Possible panic when incorrect parameters sent from frontend | |
| CVE-2026-15789 | Malicious client can bypass destination directory validation on local sources upload | |
| CVE-2026-15793 | Git source checkout from a bundle file could lead to command injection |
IV. Related Vulnerabilities
Same product: BuildKit
- CVE-2026-15793
Git source checkout from a bundle file could lead to command - CVE-2026-15792
Possible panic when incorrect parameters sent from frontend - CVE-2026-15789
Malicious client can bypass destination directory validation - CVE-2026-15788
WCOW cache mount source selector resolves NTFS junctions out - CVE-2026-33748
BuildKit Git URL subdir component can cause access to restri
Same vendor: moby
- CVE-2026-15793
Git source checkout from a bundle file could lead to command - CVE-2026-15792
Possible panic when incorrect parameters sent from frontend - CVE-2026-15789
Malicious client can bypass destination directory validation - CVE-2026-15788
WCOW cache mount source selector resolves NTFS junctions out - CVE-2026-42306
Moby: Race condition in docker cp allows bind mount redirect
Same weakness: CWE-22
- CVE-2026-13186
AppDataStorageProvider Path Traversal Deserialization Vulner - CVE-2026-44192
Ansible-lightspeed: ansible lightspeed mcp server: remote co - CVE-2026-65600
Traefik before v2.11.52 Authentication Bypass via ReplacePat - CVE-2026-56844
Veeam Software Appliance本地提权漏洞 - CVE-2026-47731
NASA AMMOS Instrument Toolkit: Path traversal resulting in a
V. Comments for CVE-2026-15791
No comments yet