Path Traversal Vulnerability in Dockge Affects Data Security and Integrity

CVE-2026-73040

What is CVE-2026-73040?

A vulnerability in Dockge allows authenticated users to exploit unvalidated stack names, leading to potential exposure of sensitive .env and Compose files. This flaw arises because the stack name validation occurs only during write operations, permitting directory traversal outside managed stacks. Consequently, unauthorized reading and deletion of critical files can occur, especially in environments where Dockge runs with elevated privileges, such as root. Instances configured without authentication further heighten the risk, exposing these operations to any logged-in user.

References