Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck
CVE-2026-121448Dockhand before 1.0.54 Path Traversal via Stack Environment Routes
High 8.3
In plain English
A high-severity path traversal in dockhand from Finsys. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Severity (CVSS 3.1)8.3High
Exploit odds (30 days)0.5%top 58.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Dockhand before 1.0.54 contains a path traversal vulnerability that allows authenticated users to read, overwrite, and delete .env files outside the stacks root by double-encoding the stack name. Attackers can send %252e%252e sequences to /api/stacks/[name]/env/raw to disclose cross-environment secrets, write into protected directories, or poison deployment variables.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
References
- GitHub Security Advisory (GHSA-q2vc-4qcx-2vm6) vendor-advisory
- VulnCheck Advisory: Dockhand before 1.0.54 Path Traversal via Stack Environment Routes third-party-advisory