{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/dockhand--1.0.54/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:dockhand:dockhand:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.3,"id":"CVE-2026-121448"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Dockhand (\u003c 1.0.54)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Dockhand"],"content_html":"\u003cp\u003eDockhand versions prior to 1.0.54 contain a path traversal vulnerability. Authenticated users can exploit this by providing double-encoded input (e.g., %252e%252e) within the stack name parameter of the /api/stacks/[name]/env/raw endpoint. This allows unauthorized access to sensitive .env files located outside the intended stack root directory.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated attackers to disclose cross-environment secrets, overwrite critical configuration files, or poison deployment variables by deleting or modifying .env files.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Dockhand to version 1.0.54 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit logs for the /api/stacks/ endpoint to identify attempts containing encoded dot-dot sequences.\u003c/li\u003e\n\u003cli\u003eRotate secrets contained within any .env files that may have been accessible during the period of exposure.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-03T16:00:34Z","date_published":"2026-11-03T16:00:34Z","id":"https://feed.craftedsignal.io/briefs/2026-11-dockhand-path-traversal/","summary":"Dockhand versions prior to 1.0.54 are vulnerable to path traversal via double-encoded input in the /api/stacks/[name]/env/raw endpoint, allowing authenticated attackers to read, overwrite, or delete sensitive .env files.","title":"Dockhand: Path traversal vulnerability (CVE-2026-121448)","url":"https://feed.craftedsignal.io/briefs/2026-11-dockhand-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Dockhand (\u003c 1.0.54)","version":"https://jsonfeed.org/version/1.1"}