CVE-2026-121448 in Dockhand
Summary
by MITRE • 11/03/2026
Dockhand before 1.0.54 contains a path traversal vulnerability that allows authenticated users to read, overwrite, and delete .env files outside the stacks root by double-encoding the stack name. Attackers can send %252e%252e sequences to /api/stacks/[name]/env/raw to disclose cross-environment secrets, write into protected directories, or poison deployment variables.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in Dockhand prior to version 1.0.54 represents a critical path traversal flaw that exploits insufficient input validation within the API endpoint responsible for handling environment variable files. Specifically, the /api/stacks/[name]/env/raw route fails to properly sanitize or canonicalize user-supplied stack names before using them as part of file system operations. This architectural oversight allows an authenticated attacker to manipulate the intended directory structure by employing double-encoding techniques on the path segments. By submitting sequences such as %252e%252e, which decode first to .. and subsequently resolve to parent directories during processing, the application inadvertently permits access beyond the designated stack root directory. This behavior aligns with CWE-22, Improper Limitation of a Pathname to a Restricted Directory, where software does not sufficiently neutralize special elements within file paths that can cause unintended navigation across restricted folders or resources.
From an operational perspective, this flaw poses severe risks to application security and data integrity. Because the vulnerability grants authenticated users the ability to read files outside their designated scope, attackers can exfiltrate sensitive cross-environment secrets stored in .env files belonging to other stacks or system-level configurations. This disclosure of credentials, API keys, or database connection strings undermines the principle of least privilege and compartmentalization essential for secure multi-tenant or microservices architectures. Furthermore, the capability to overwrite these files enables attackers to inject malicious environment variables that can alter application behavior upon restart or deployment cycles. In worst-case scenarios, poisoning deployment variables with harmful values such as arbitrary command execution payloads or backdoor configurations can lead to remote code execution, effectively compromising the underlying host infrastructure and any services dependent on those environments.
The exploitation of this vulnerability is categorized under MITRE ATT&CK technique T1530, Data from Information Repositories, due to the unauthorized access and extraction of sensitive data stored in configuration files. Additionally, it relates to T1496, Environment Modification, as attackers can alter system or application settings through file manipulation. The impact extends beyond immediate data theft; persistent modification of environment variables can disrupt service availability by introducing invalid configurations that cause crashes or degrade performance during automated deployments. This creates a sustained foothold for further lateral movement within the container orchestration ecosystem if those compromised environments are used to access other internal services.
Mitigation strategies must prioritize both immediate remediation and long-term architectural hardening. The primary solution is to upgrade Dockhand to version 1.0.54 or later, where this path traversal issue has been addressed through improved input validation and strict canonicalization of file paths before any filesystem interaction. For systems that cannot be immediately updated, implementing a reverse proxy with rigorous URL decoding rules can help strip double-encoded sequences before they reach the application layer. Additionally, enforcing principle of least privilege by restricting file system permissions for the user account running Dockhand ensures that even if path traversal is achieved, write access to critical directories remains blocked. Regular auditing of environment variable files and monitoring for anomalous read or write operations on .env locations can also aid in early detection of exploitation attempts.