{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/dockwatch--0.6.567/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-58455"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=95C7431E-4F72-576F-BC08-274AD2697E6D\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["Dockwatch \u003c= 0.6.567"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","rce","web-application","linux"],"_cs_type":"advisory","_cs_vendors":["Notifiarr"],"content_html":"\u003cp\u003eA critical unauthenticated OS command injection vulnerability, tracked as CVE-2026-58455, affects Dockwatch versions through 0.6.567. This flaw stems from a critical oversight where \u003ccode\u003eloader.php\u003c/code\u003e fails to exit after an incomplete authentication redirect, allowing attackers to \u0026quot;seed\u0026quot; a necessary session flag. Subsequently, unsanitized user input passed to the \u003ccode\u003eshell_exec()\u003c/code\u003e function within \u003ccode\u003eajax/compose.php\u003c/code\u003e can be leveraged for arbitrary command execution. Attackers can inject malicious shell commands via the \u003ccode\u003ecomposePath\u003c/code\u003e POST parameter during the \u003ccode\u003ecomposePull\u003c/code\u003e action. This vulnerability leads to full host compromise, a severe risk for organizations using Dockwatch, particularly if the standard deployment includes mounting the Docker socket, which could facilitate container escapes or further system access. Defenders must patch immediately to prevent exploitation.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eIncomplete Authentication Bypass\u003c/strong\u003e: An unauthenticated attacker initiates a request to \u003ccode\u003eloader.php\u003c/code\u003e to exploit a missing \u003ccode\u003eexit()\u003c/code\u003e after an authentication redirect, allowing them to seed a required session flag.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCrafted HTTP POST Request\u003c/strong\u003e: The attacker then sends a specially crafted HTTP POST request to the \u003ccode\u003e/ajax/compose.php\u003c/code\u003e endpoint of the vulnerable Dockwatch instance.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCommand Injection Payload\u003c/strong\u003e: This POST request includes the \u003ccode\u003ecomposePath\u003c/code\u003e parameter, which contains unsanitized arbitrary shell commands (e.g., \u003ccode\u003ecomposePath=;id;\u003c/code\u003e or \u003ccode\u003ecomposePath=;cat /etc/passwd;\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRemote Command Execution\u003c/strong\u003e: The Dockwatch application processes the \u003ccode\u003ecomposePath\u003c/code\u003e parameter and, due to a lack of proper input sanitization, passes the attacker-controlled input directly to the \u003ccode\u003eshell_exec()\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eHost Compromise\u003c/strong\u003e: The injected shell commands are executed on the underlying operating system with the privileges of the Dockwatch process, granting the attacker control over the host.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePrivilege Escalation/Lateral Movement\u003c/strong\u003e: If the Docker socket is mounted (a common deployment scenario for container management tools), the executed commands can interact with the Docker daemon, potentially enabling container escape, privilege escalation, or lateral movement within the host or network.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eImpact Achieved\u003c/strong\u003e: Full host compromise is achieved, enabling data exfiltration, deployment of further malicious payloads (e.g., ransomware, backdoors), or continued attack activities.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of CVE-2026-58455 results in full host compromise, allowing unauthenticated remote attackers to execute arbitrary operating system commands. This provides attackers complete control over the compromised Dockwatch server, enabling them to steal sensitive data, deploy ransomware or other malicious software, establish persistent access, or pivot to other systems within the network. If the Docker socket is mounted, attackers can manipulate containers, potentially escaping to the host system or accessing containerized applications and data. The high CVSS v3.1 Base Score of 9.8 reflects the critical nature of this vulnerability.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately patch Dockwatch to a version beyond 0.6.567 to remediate CVE-2026-58455.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule provided in this brief to your SIEM to detect attempts at exploiting CVE-2026-58455.\u003c/li\u003e\n\u003cli\u003eEnable comprehensive web server logging for all Dockwatch instances, specifically capturing \u003ccode\u003ecs-method\u003c/code\u003e, \u003ccode\u003ecs-uri-stem\u003c/code\u003e, \u003ccode\u003ecs-uri-query\u003c/code\u003e, and \u003ccode\u003esc-status\u003c/code\u003e to facilitate detection of exploitation attempts.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for any suspicious POST requests to \u003ccode\u003e/ajax/compose.php\u003c/code\u003e containing shell metacharacters in the \u003ccode\u003ecomposePath\u003c/code\u003e query parameter as described in the attack chain.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-21T18:38:51Z","date_published":"2026-07-02T16:25:32Z","id":"https://feed.craftedsignal.io/briefs/2026-07-dockwatch-os-command-injection/","summary":"Remote attackers can exploit an unauthenticated OS command injection vulnerability (CVE-2026-58455) in Dockwatch versions up to 0.6.567, arising from a missing exit() after an authentication redirect in loader.php combined with unsanitized input passed to shell_exec() in ajax/compose.php, to execute arbitrary shell commands leading to full host compromise, especially in deployments where the Docker socket is mounted.","title":"CVE-2026-58455: Dockwatch Unauthenticated OS Command Injection","url":"https://feed.craftedsignal.io/briefs/2026-07-dockwatch-os-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Dockwatch \u003c= 0.6.567","version":"https://jsonfeed.org/version/1.1"}