CVE-2026-73040

Received Received - Intake

Path Traversal in Dockge Stack Management

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: VulnCheck

Description

Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate(), which requires the name to match ^[a-z0-9_-]+$, is reached from save() alone, while the path getter returns path.join(this.server.stacksDir, this.name) and Stack.getStack builds path.join(server.stacksDir, stackName) with no check. The socket handlers in backend/agent-socket-handlers/docker-socket-handler.ts confirm the caller is logged in and that the name is a string, then pass it straight to Stack.getStack, so a name containing traversal sequences resolves outside the managed stacks directory. An authenticated user can therefore read the composeENV and composeYAML values of any directory the server process can reach, which discloses the secrets in that directory's .env or Compose file, and can invoke delete(), which runs docker compose down and then fsAsync.rm on the traversed path with recursive and force set, removing that directory. Disclosure is limited to files named .env or an accepted Compose filename, and deletion requires the target directory to hold a valid Compose file so that docker compose down exits successfully. Dockge commonly runs as root with access to the Docker socket, so the reachable set includes unrelated applications on the host. Instances configured with disableAuth, a supported option that logs the caller in as admin automatically, expose both operations without authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-73040

EUVD

EUVD-2026-63588

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability in Dockge allows authenticated users to bypass path validation and access or delete files outside the intended stacks directory. The issue occurs because stack names are only checked during saving, not when retrieving or deleting stacks. An attacker can use directory traversal sequences in the stack name to read sensitive files like .env or Compose files, or delete directories containing valid Compose files. This is possible even without authentication if the instance is configured with disableAuth.

Detection Guidance

Check for unauthorized access to Docker stacks or directories by reviewing Docker logs and filesystem access. Look for unexpected directory deletions or reads of .env files. Inspect Dockge logs for traversal sequences in stack names.

Impact Analysis

An attacker could read sensitive configuration files or secrets stored in .env or Compose files, leading to data breaches. They could also delete directories containing valid Compose files, potentially disrupting services or applications managed by Dockge. Since Dockge often runs as root with access to the Docker socket, the impact could extend to unrelated applications on the host system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Disclosure of secrets or unauthorized deletion of files may result in non-compliance, potential fines, and reputational damage for organizations handling regulated data.

Mitigation Strategies

Update Dockge to the latest version where the stack name validation is fixed. Disable the disableAuth option if enabled. Restrict access to the Docker socket and ensure Dockge runs with minimal privileges.

Hi! I’m here to help you understand CVE-2026-73040. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70