CVE-2026-45405

Name of the Vulnerable Software and Affected Versions Dokku versions prior to 0.38.2

Description The git:from-archive and certs:add commands extract user-supplied tar or zip archives into temporary directories without sanitizing member paths or preventing symlink traversal. Because GNU tar creates symlinks during extraction and follows them for subsequent entries, an attacker can write arbitrary files to any location writable by the dokku user, such as overwriting the ~/.ssh/authorized keys file to obtain unrestricted shell access.

Recommendations Update to version 0.38.2.