01 Record

CVE-2026-73040

Dockge Path Traversal via Unvalidated Stack Name Allows Arbitrary Compose and .env Disclosure and Arbitrary Directory Deletion

HighPUBLISHEDCNA: VulnCheck

Base score8.7 CVSS v4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

02 Description

Dockge Path Traversal via Unvalidated Stack Name Allows Arbitrary Compose and .env Disclosure and Arbitrary Directory Deletion

Published

2026-08-20 20:29Z1 DAY AGO

Last updated

2026-08-21 16:21Z9 HR AGO

Reserved

2026-08-10

Assigning CNA

VulnCheck

Record state

PUBLISHED

Severity

High (CVSS 8.7)

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Weaknesses

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Base

SSVC decision

ExploitationpocAutomatablenoTechnical Impacttotal

Data version

5.2

Document digest

320cb60608cb294a604aecc2559832b6271310a65c7539e6f9cf66c28129a8ae

VendorProductVersionsPlatforms

louislamdockge0 to 1.5.0—

github.comGitHub Issue #994https://github.com/louislam/dockge/issues/994issue-tracking
github.comUnvalidated path getter at 1.5.0https://github.com/louislam/dockge/blob/1.5.0/backend/stack.ts#L155-L157technical-description
github.comStack.getStack joining an unvalidated stack name at 1.5.0https://github.com/louislam/dockge/blob/1.5.0/backend/stack.ts#L377-L379technical-description
github.comdelete() removing the traversed path recursively at 1.5.0https://github.com/louislam/dockge/blob/1.5.0/backend/stack.ts#L218-L232technical-description
github.comgetStack and deleteStack handlers checking only the argument type at 1.5.0https://github.com/louislam/dockge/blob/1.5.0/backend/agent-socket-handlers/docker-socket-handler.ts#L43-L78technical-description
github.comhttps://github.com/louislam/dockgeproduct
www.vulncheck.comVulnCheck Advisory: Dockge Path Traversal via Unvalidated Stack Name Allows Arbitrary Compose and .env Disclosure and Arbitrary Directory Deletionhttps://www.vulncheck.com/advisories/dockge-path-traversal-via-unvalidated-stack-name-allows-arbitrary-compose-and-env-disclosure-and-arbitrary-directory-deletionthird-party-advisory