CVE-2026-105137: Laradock Build Process Dockerfile code download
A vulnerability was found in Laradock up to 20.4. Impacted is an unknown function of the file workspace/Dockerfile of the component Build Process. The manipulation results in download of code without integrity check. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
Laradock installations up to version 20.4 should be reviewed, particularly where the workspace/Dockerfile build process is used. The issue is in that Dockerfile component.
What conditions are required for exploitation?
The attack can be launched remotely and does not require privileges, but it requires user interaction and has high attack complexity. A public exploit is available, although exploitation is considered difficult.
How can I check whether my build process is exposed?
Check whether your Laradock version is up to 20.4 and inspect workspace/Dockerfile for code downloads that lack an integrity check. Builds using such downloads are the relevant exposure path.