CVE-2026-45405: Dokku: Arbitrary File Write via Tar Symlink Traversal in git:from-archive and certs:add
Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:from-archive and certs:add commands extract user-supplied tar/zip archives into temporary directories without sanitizing member paths or preventing symlink traversal. GNU tar creates symlinks during extraction and follows them for subsequent entries, allowing an attacker to write arbitrary files anywhere writable by the dokku user — including overwriting ~/.ssh/authorizedkeys to gain unrestricted shell access. This vulnerability is fixed in 0.38.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
dokkuto a version that resolves this vulnerability.Fixed in 0.38.2 - Compensating control
Because this flaw can overwrite files such as ~/.ssh/authorized_keys to gain shell access, restrict any untrusted users from invoking Dokku commands that accept user-supplied tar/zip archives for git:from-archive and certs:add (or otherwise ensure only trusted inputs/tenants can submit those archives).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45405?
The severity of CVE-2026-45405 is rated as critical with a score of 9.
What vulnerability does CVE-2026-45405 describe?
CVE-2026-45405 describes an arbitrary file write vulnerability via tar symlink traversal in Dokku commands.
How do I fix CVE-2026-45405?
To fix CVE-2026-45405, update Dokku to version 0.38.2 or later, where this vulnerability has been addressed.
Which commands in Dokku are affected by CVE-2026-45405?
The git:from-archive and certs:add commands in Dokku are affected by CVE-2026-45405.
What type of applications are impacted by CVE-2026-45405?
Applications using Dokku as a platform-as-a-service (PaaS) can be impacted by CVE-2026-45405 due to symlink traversal risks.