CVE-2026-113354: Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/content
Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, and SSH keys from the Dockhand container.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dockhandto a version that resolves this vulnerability.Fixed in 1.0.46
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any non-admin Dockhand user who has the stacks:edit permission can exploit it. No user interaction is required.
What access can an attacker gain?
An attacker can use an absolute path in the endpoint's path parameter to read files available inside the Dockhand container. Examples include /etc/shadow, /etc/passwd, Git .git/config credential data, and SSH keys.
Are deployments running version 1.0.46 affected?
The issue affects Dockhand versions before 1.0.46. The provided release information identifies v1.0.46 as the fixed version.