Skip to content
OpenAdvisories

Product · louislam

dockge

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.8
    CVE-2026-73040

    Dockge Path Traversal via Unvalidated Stack Name Allows Arbitrary Compose and .env Disclosure and Arbitrary Directory Deletion

    Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate(), which requires the name to match ^[a-z0-9_-]+$, is reached from save() alone, while the path getter returns path.join(this.server.stacksDir, this.nam…

    louislam dockge