{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/dockge/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-73040"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Dockge"],"_cs_severities":["high"],"_cs_tags":["cve-2026-73040","path-traversal","rce","web-vulnerability"],"_cs_type":"advisory","_cs_vendors":["Dockge"],"content_html":"\u003cp\u003eDockge, a management tool for Docker Compose stacks, contains a path traversal vulnerability identified as CVE-2026-73040. The vulnerability exists because the application validates stack names only during the 'save' operation. The 'validate()' function in 'backend/stack.ts' enforces an allow-list regex (^[a-z0-9_-]+$), but this check is bypassed by other functions like 'Stack.getStack', which directly constructs paths using user-provided names without sanitization.\u003c/p\u003e\n\u003cp\u003eAttackers can pass traversal sequences (e.g., '../') via socket handlers to target files and directories outside the intended 'stacksDir'. An authenticated user, or any user on an instance configured with 'disableAuth', can read sensitive files like '.env' or compose YAML files, or trigger recursive deletion of directories if the target contains a valid Compose file. Given that Dockge often runs with root privileges and active Docker socket access, this vulnerability allows for broad system-level impact, including the deletion of unrelated host directories or the theft of credentials stored in environment files.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in unauthorized disclosure of sensitive secrets (e.g., database passwords, API keys) from '.env' files or arbitrary file deletion on the underlying host filesystem. The impact is critical due to the typical execution of Dockge as the root user with unrestricted access to the Docker socket. The vulnerability affects instances where authentication is enabled (requiring valid credentials) and is trivially exploitable on instances configured with 'disableAuth'.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade to the patched version of Dockge immediately upon release to address the validation gap in 'backend/stack.ts'.\u003c/li\u003e\n\u003cli\u003eDisable the 'disableAuth' configuration option in all production environments to require mandatory authentication.\u003c/li\u003e\n\u003cli\u003eMonitor web server and Docker socket proxy logs for requests containing traversal patterns such as '../' or encoded directory sequences.\u003c/li\u003e\n\u003cli\u003eRestrict access to the Docker socket to ensure that even if the application is compromised, the impact on the broader host filesystem is minimized.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-20T21:19:28Z","date_published":"2026-08-20T21:19:28Z","id":"https://feed.craftedsignal.io/briefs/2026-08-dockge-path-traversal/","summary":"Dockge fails to validate stack names in read and delete operations, allowing authenticated or unauthenticated attackers to perform arbitrary file reads or recursive directory deletion via path traversal.","title":"Path Traversal Vulnerability in Dockge (CVE-2026-73040)","url":"https://feed.craftedsignal.io/briefs/2026-08-dockge-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Dockge","version":"https://jsonfeed.org/version/1.1"}