Dockhand (< 1.0.54) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/dockhand--1.0.54/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 16:00:34 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDockhand: Path traversal vulnerability (CVE-2026-121448)https://feed.craftedsignal.io/briefs/2026-11-dockhand-path-traversal/Tue, 03 Nov 2026 16:00:34 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-dockhand-path-traversal/Dockhand versions prior to 1.0.54 are vulnerable to path traversal via double-encoded input in the /api/stacks/[name]/env/raw endpoint, allowing authenticated attackers to read, overwrite, or delete sensitive .env files.Dockhand versions prior to 1.0.54 contain a path traversal vulnerability. Authenticated users can exploit this by providing double-encoded input (e.g., %252e%252e) within the stack name parameter of the /api/stacks/[name]/env/raw endpoint. This allows unauthorized access to sensitive .env files located outside the intended stack root directory.

Impact

Successful exploitation allows authenticated attackers to disclose cross-environment secrets, overwrite critical configuration files, or poison deployment variables by deleting or modifying .env files.

Recommendation

  • Upgrade Dockhand to version 1.0.54 or later immediately.
  • Audit logs for the /api/stacks/ endpoint to identify attempts containing encoded dot-dot sequences.
  • Rotate secrets contained within any .env files that may have been accessible during the period of exposure.
]]>highadvisory