Path Traversal Vulnerability in Dockhand by Finsys

CVE-2026-121448

What is CVE-2026-121448?

Dockhand versions prior to 1.0.54 are susceptible to a path traversal vulnerability that could be exploited by authenticated users. This issue allows attackers to read, overwrite, or delete critical .env files located outside the designated stack root. By leveraging double-encoded sequences in their requests, such as %252e%252e, attackers can expose sensitive information across environments, manipulate deployment variables, or gain unauthorized access to protected directories.

References