CVE-2026-102332 in Dozzle
Summary
by MITRE • 09/29/2026
Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive entry names in the log download endpoint. Attackers who can label containers can use path traversal sequences to write files outside the extraction directory when users download and extract logs.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in Dozzle versions prior to 11.1.2 represents a critical security flaw rooted in improper input validation within the application's log downloading functionality. Specifically, the software fails to adequately sanitize container display names before incorporating them into file paths for ZIP archive entries. This lack of sanitization allows an attacker who possesses the ability to label or rename Docker containers to inject malicious path traversal sequences, such as dot-dot-slash characters, directly into the generated archive structure. The core technical failure lies in the assumption that container labels are safe inputs for filesystem operations without rigorous validation against directory traversal patterns.
When a user initiates a log download through the Dozzle interface, the system constructs a ZIP file where each entry corresponds to logs from specific containers. If an attacker has previously manipulated the display name of a target container by injecting path traversal sequences during the labeling process, these malicious strings are embedded into the metadata of the resulting archive entries. This creates a classic Zip Slip vulnerability scenario, where the integrity of the extraction process is compromised because the file paths contained within the archive do not align with the intended directory structure on the server or client side.
The operational impact of this flaw becomes apparent when an end-user downloads and extracts these logs using standard archival tools. Most common ZIP extraction utilities automatically resolve relative path components during decompression without verifying that the resulting absolute path remains within the designated output directory. Consequently, if a user extracts the compromised archive on their local machine or server, files can be written to arbitrary locations outside the expected log folder. This capability enables an attacker to overwrite critical system files, inject malicious scripts into executable directories, or create hidden backdoors in sensitive areas of the filesystem, depending on the privileges under which the extraction occurs and the accessibility of target paths from within the container environment.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. It also maps to MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse via file system manipulation, specifically leveraging archive formats for initial access or persistence if the extracted files are subsequently executed. The attack vector requires local container labeling privileges, which may limit its scope in highly restricted environments but remains a significant risk in shared hosting or multi-tenant Docker setups where users have control over their own container metadata.
Mitigation strategies must focus on both immediate patching and long-term defensive coding practices. Users should upgrade to Dozzle version 11.1.2 or later, which implements proper sanitization of container names before they are used in file path construction. For environments unable to update immediately, administrators can enforce strict policies regarding container labeling to prevent the use of special characters that could facilitate traversal attacks. Additionally, implementing server-side validation on any user-supplied input destined for filesystem operations is essential. Security teams should also monitor extraction logs and configure archival tools to reject entries with absolute paths or path traversal sequences during decompression, thereby neutralizing the exploit even if vulnerable archives are processed.