CVE-2026-113354 in Dockhand
Summary
by MITRE • 10/20/2026
Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, and SSH keys from the Dockhand container.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in Dockhand versions prior to 1.0.46 represents a critical insecure direct object reference flaw that facilitates arbitrary file reads within the application environment. This security defect is rooted in the improper validation of user-supplied input, specifically targeting the path parameter utilized by the /api/system/files/content endpoint. The core technical failure lies in the server-side logic which fails to sanitize or restrict the absolute paths provided by the client. Instead of resolving relative paths against a designated base directory and enforcing strict boundary checks, the application accepts arbitrary file system locations without adequate verification. This allows an authenticated user with stacks:edit permissions to bypass intended access controls and traverse outside the expected application directories into sensitive areas of the host operating system or container filesystem.
From a classification perspective, this vulnerability aligns directly with CWE-22 Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. The attack vector is classified under MITRE ATT&CK technique T1083 File and Directory Discovery, where adversaries probe the system for sensitive information. Because the endpoint requires authentication but only demands stacks:edit permissions rather than administrative privileges, the scope of potential attackers is significantly broadened compared to typical high-privilege exploits. This means that any user with moderate access rights can leverage this flaw to extract critical configuration files and credentials stored on the underlying infrastructure hosting the Dockhand instance.
The operational impact of this vulnerability is severe due to the sensitivity of the data accessible through it. By supplying absolute paths such as /etc/shadow or /etc/passwd, an attacker can retrieve password hashes and user account details respectively, which are foundational for offline cracking attacks aimed at gaining higher privileges. Furthermore, access to .git/config files within repositories managed by Dockhand exposes remote repository URLs that may contain embedded credentials or tokens used for authentication with external version control platforms like GitHub or GitLab. The ability to read SSH keys stored in the container environment is particularly dangerous as it allows an attacker to authenticate to other systems without needing passwords, potentially leading to lateral movement across the network and full compromise of interconnected services.
Mitigation strategies must prioritize immediate patching to version 1.0.46 or later where this input validation issue has been resolved. In addition to upgrading, organizations should implement strict allow-listing for file paths on the server side, ensuring that only files within specific, expected directories can be accessed via the API endpoint. Input sanitization techniques such as canonicalizing path strings and rejecting any input containing directory traversal sequences like ../ or absolute path indicators are essential defensive measures. Furthermore, principle of least privilege should be enforced by reviewing stacks:edit permissions to ensure they do not grant unnecessary access to system-level resources, thereby reducing the blast radius if similar vulnerabilities exist in other parts of the application stack.