Live › vulnerability › CVE-2026-121448
Dockhand before 1.0.54 lets an authenticated user use double-encoded path sequences in a stack name to reach .env files outside the stacks directory. An attacker can read cross-environment secrets, overwrite files in protected directories, or change deployment variables.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:22 UTC. All times on this page are UTC.
Teams running self-hosted Dockhand before 1.0.54 where users have accounts on the web interface or API. Exposure depends on who holds authenticated access to stack environment files; instances with only trusted, admin-only users carry less risk but should still upgrade.
No product ranges from the sources yet.
1.0.54./api/stacks/[name]/env/raw requests in web server or proxy logs containing %252e%252e.1.0.54 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Dockhand before 1.0.54 contains a path traversal vulnerability that allows authenticated users to read, overwrite, and delete .env files outside the stacks root by double-encoding the stack name. Attackers can send %252e%252e sequences to /api/stacks/[name]/env/raw to disclose cross-environment secrets, write into protected directories, or poison deployment variables.
This page as .md · .json · in your agent: get_signal("CVE-2026-121448")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.