HIGH 8.7 NVD
CVE-2026-121448
Dockhand before 1.0.54 contains a path traversal vulnerability that allows authenticated users to read, overwrite, and delete .env files outside the stacks root
Dockhand before 1.0.54 contains a path traversal vulnerability that allows authenticated users to read, overwrite, and delete .env files outside the stacks root by double-encoding the stack name. Attackers can send %252e%252e sequences to /api/stacks/[name]/env/raw to disclose cross-environment secrets, write into protected directories, or poison deployment variables.
References
- https://github.com/Finsys/dockhand/security/advisories/GHSA-q2vc-4qcx-2vm6
- https://www.vulncheck.com/advisories/dockhand-before-1.0.54-path-traversal-via-stack-envir
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-11-03 via NVD.
vulnfeed aggregates 18261 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.