CVE-2026-113354
Received Received - Intake

Arbitrary File Read in Dockhand Before 1.0.46

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulnCheck

Description
Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, and SSH keys from the Dockhand container.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113354
EUVD
EUVD-2026-104925

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Finsys dockhand 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Dockhand before 1.0.46 has an arbitrary file read vulnerability. Non-admin users with stacks:edit permission can read any file on the Dockhand container's filesystem via the /api/system/files/content endpoint by supplying absolute paths. This includes sensitive files like /etc/shadow, /etc/passwd, git credentials, and SSH keys.

Detection Guidance

Check if your Dockhand version is below 1.0.46 by running: docker inspect <container_name> | grep Image. If vulnerable, test the endpoint manually with: curl -u <username>:<password> 'http://<host>/api/system/files/content?path=/etc/passwd' to see if file contents are exposed.

Impact Analysis

Attackers could access sensitive system files, credentials, and secrets stored in the Dockhand container. This may lead to data breaches, unauthorized access to other systems, or exposure of confidential information like passwords and API keys.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to personal or sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A breach could result in legal penalties and reputational damage.

Mitigation Strategies

Upgrade Dockhand to version 1.0.46 or later immediately. If upgrading is not possible, restrict access to the /api/system/files/content endpoint by network policies or firewall rules. Remove stacks:edit permissions from non-admin users until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113354. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart