GHSA-q2vc-4qcx-2vm6: Dockhand before 1.0.54 Path Traversal via Stack Environment Routes
Dockhand before 1.0.54 contains a path traversal vulnerability that allows authenticated users to read, overwrite, and delete .env files outside the stacks root by double-encoding the stack name. Attackers can send %252e%252e sequences to /api/stacks/[name]/env/raw to disclose cross-environment secrets, write into protected directories, or poison deployment variables.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Dockhand user can exploit it. The attack is network-accessible and does not require user interaction, but it does require valid privileges to access the affected API route.
Which endpoint and input are involved?
The affected route is /api/stacks/[name]/env/raw. An attacker supplies a double-encoded traversal sequence such as %252e%252e in the stack name.
What is the practical impact?
An attacker may read, overwrite, or delete .env files outside the stacks root. This can expose secrets from other environments, alter protected files, or poison deployment variables.
Which versions are affected?
Dockhand versions before 1.0.54 are affected. Upgrade to 1.0.54 or later.