Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-73040— Dockge Path Traversal via Unvalidated Stack Name Allows Arbitrary Compose and .env Disclosure and Arbitrary Directory Deletion

Quick assessment

Affected
louislam dockge
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Louis Lam Dockge是Louis Lam个人开发者的一款Docker Compose管理工具。 Louis Lam Dockge 1.5.0及之前版本存在路径遍历漏洞，该漏洞源于对stack名称的验证不充分，仅在写入路径时进行校验，导致路径遍历，可能允许已认证用户读取任意目录中的composeENV和composeYAML信息，泄露.env或Compose文件中的机密数据，并可能删除任意目录。

CVSS 8.8 · High EPSS 0.94% · P60

Affected Version Matrix 1

VendorProduct Version RangeStatus
louislam dockge ≤ 1.5.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-73040

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Dockge Path Traversal via Unvalidated Stack Name Allows Arbitrary Compose and .env Disclosure and Arbitrary Directory Deletion
Source: CVE Program / CVE List V5
Vulnerability Description
Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate(), which requires the name to match ^[a-z0-9_-]+$, is reached from save() alone, while the path getter returns path.join(this.server.stacksDir, this.name) and Stack.getStack builds path.join(server.stacksDir, stackName) with no check. The socket handlers in backend/agent-socket-handlers/docker-socket-handler.ts confirm the caller is logged in and that the name is a string, then pass it straight to Stack.getStack, so a name containing traversal sequences resolves outside the managed stacks directory. An authenticated user can therefore read the composeENV and composeYAML values of any directory the server process can reach, which discloses the secrets in that directory's .env or Compose file, and can invoke delete(), which runs docker compose down and then fsAsync.rm on the traversed path with recursive and force set, removing that directory. Disclosure is limited to files named .env or an accepted Compose filename, and deletion requires the target directory to hold a valid Compose file so that docker compose down exits successfully. Dockge commonly runs as root with access to the Docker socket, so the reachable set includes unrelated applications on the host. Instances configured with disableAuth, a supported option that logs the caller in as admin automatically, expose both operations without authentication.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Louis Lam Dockge 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Louis Lam Dockge是Louis Lam个人开发者的一款Docker Compose管理工具。 Louis Lam Dockge 1.5.0及之前版本存在路径遍历漏洞，该漏洞源于对stack名称的验证不充分，仅在写入路径时进行校验，导致路径遍历，可能允许已认证用户读取任意目录中的composeENV和composeYAML信息，泄露.env或Compose文件中的机密数据，并可能删除任意目录。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
louislam dockge 0 ~ 1.5.0 -

II. Public POCs for CVE-2026-73040

# POC Description Source Link Shenlong Link
AI-Generated POC Verified env Premium
Reproduced successfully in a real sandbox · Below is the actual recording of building the environment and exploiting the vulnerability.
Success marker: VULNERABLE: path traversal via stack name "../../target" disclosed /app/target/.env containing PROOF_664c2a93e48ec221
Reproduction recording is a Pro+ exclusive
Watch the full sandbox build + live exploit recording for this CVE. Limited-time ¥499/mo.
Upgrade to Pro+
claude_code · 8830 chars
GitHub 复现环境（可 clone 直接跑）
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-73040

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-73040 (4)

Vendor Advisories for CVE-2026-73040 (1)

Proof of Concept for CVE-2026-73040 (1)

Vendor Pages for CVE-2026-73040 (1)

IV. Related Vulnerabilities

Same vendor: louislam
Same weakness: CWE-22

V. Comments for CVE-2026-73040

No comments yet

Leave a comment