CVE-2026-73040

Name of the Vulnerable Software and Affected Versions Dockge (affected versions not specified)

Description Insufficient validation of stack names occurs because the allow-list check in the validate() function within backend/stack.ts is only applied during the save process. The Stack.getStack function and the path getter in backend/stack.ts use path.join() without validating the stackName variable, allowing path traversal sequences to resolve outside the managed stacks directory. In backend/agent-socket-handlers/docker-socket-handler.ts, socket handlers pass the name directly to Stack.getStack after only verifying that the caller is logged in and the name is a string. This allows an authenticated user to read composeENV and composeYAML values from any directory accessible to the server process, disclosing secrets in .env or Compose files. Additionally, an attacker can call the delete() function, which executes docker compose down followed by fsAsync.rm with recursive and force options, deleting the targeted directory. This risk is amplified when Dockge runs as root or when the disableAuth option is enabled, which allows these operations without authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.