Skip to content
OpenAdvisories
Critical · 9.8 Scanner template Public exploit CVE-2026-58455 EUVD-2026-41405GHSA-cgfv-42v7-7f53

Dockwatch 0.6.567 Unauthenticated OS Command Injection via ajax/compose.php

Published Jul 2, 2026 · Updated Nov 8, 2026 · Assigned by VulnCheck

Vendor: Notifiarr Product: dockwatch

Description

Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands by exploiting a missing exit() after an authentication redirect in loader.php combined with unsanitized input passed to shell_exec() in ajax/compose.php. Attackers can seed the required session flag through the incomplete auth check, then inject arbitrary commands via the composePath POST parameter in the composePull action to achieve full host compromise, facilitated by the standard deployment mounting of the Docker socket.

Affected products

VendorProductAffectedFixed
Notifiarr dockwatch ≤ 0.6.567 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • Boreas37/CVE-2026-58455-PoC ★ 2 · Aug 21, 2026

    PoC for CVE-2026-58455: Dockwatch <=0.6.567 unauthenticated RCE. Stdlib-only Python.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

References