CVE-2026-126321: Dockhand before 1.0.55 Path Traversal via Symlink in File-Browser Endpoints
Dockhand before 1.0.55 contains a path traversal vulnerability that allows authenticated users with stacks:edit to bypass the file-browser path guard by combining symlinks with '..' sequences. Attackers can read /proc/self/environ, the SQLite database, and the encryption key via /api/system/files/content, or move them using the stack relocate endpoint, exposing stored credentials.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker must be authenticated and have the stacks:edit permission. No user interaction is required, and the vulnerable endpoints are network-accessible.
What information or assets could be exposed?
An attacker can read /proc/self/environ, the SQLite database, and the encryption key through /api/system/files/content. Exposure of the database and encryption key can expose stored credentials.
Can an attacker modify files as well as read them?
The stack relocate endpoint can be used to move the targeted files. The provided information specifically identifies file movement and does not establish arbitrary file overwrite or deletion.
What versions are affected?
Dockhand versions before 1.0.55 are affected. Upgrading to 1.0.55 or later addresses the stated vulnerable version range.