Arbitrary File Read Vulnerability in Dockhand Affected by Finsys
CVE-2026-113354

7.1HIGH

Key Information:

Vendor

Finsys

Status
Dockhand
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113354?

Dockhand prior to version 1.0.46 is susceptible to an arbitrary file read vulnerability. This flaw allows non-administrative users with specific permissions to access sensitive files by manipulating the path parameter in the /api/system/files/content endpoint. Malicious users could exploit this vulnerability to read critical files such as /etc/shadow and /etc/passwd, potentially exposing sensitive credentials and SSH keys within the Dockhand container. It is essential for users to upgrade to the latest version to mitigate these security risks.

Affected Version(s)

dockhand 0 < 1.0.46

References

https://github.com/Finsys/dockhand/security/advisories/GH...
vendor-advisory
https://github.com/Finsys/dockhand/commit/5af4e69eb20bde4...
patch
https://github.com/Finsys/dockhand/releases/tag/v1.0.46
release-notes

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Allan Victor
Bruno Alvarenga
.