Medium
6.5
Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users...
CVE-2026-113354
First seen on SecPulse
Original description The description as published by the source.
Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, and SSH keys from the Dockhand container.
Source: NIST National Vulnerability Database NVD GitHub Advisory
References
- web github.com
- web github.com
- web github.com
- web github.com
- web vulncheck.com
- web nvd.nist.gov
- web github.com