Critical Path Traversal Vulnerability in Dockge Exposes Secrets and Allows Arbitrary Deletion

A critical path traversal vulnerability, identified as CVE-2026-73040, has been discovered in Dockge, a web-based UI for managing Docker Compose projects. The flaw stems from insufficient validation of stack names on the write path. Specifically, while the `validate()` function checks stack names, this check is only applied during the `save()` operation. Other functions, like `getStack()`, which is used by socket handlers, directly construct file paths using user-supplied stack names without proper sanitization. This allows an authenticated attacker to craft a malicious stack name containing path traversal sequences (e.g., `../`) to access directories outside the intended `stacksDir`. This vulnerability is highly significant for any organization or individual utilizing Dockge to manage their Docker Compose deployments. The implications are severe: an authenticated user can read the contents of `.env` files and Compose YAML files from any directory accessible by the Dockge server process. This directly leads to the disclosure of sensitive credentials, API keys, and other configuration secrets. Furthermore, the vulnerability permits the invocation of the `delete()` operation on traversed paths, which executes `docker compose down` and then recursively removes the targeted directory. This means an attacker could not only steal secrets but also wipe out critical application data or even parts of the host system's filesystem. The risk is amplified because Dockge commonly runs with root privileges and access to the Docker socket, granting it broad control over the host. This incident highlights a recurring theme in cloud-native security: the critical importance of input validation and least privilege. Path traversal vulnerabilities are not new, but they continue to emerge in applications that handle file system operations based on user input. In the context of container orchestration and management UIs, such flaws are particularly dangerous because these tools often operate with elevated permissions to interact with the Docker daemon or Kubernetes API. Similar vulnerabilities have been seen in other management interfaces where a lack of stringent input sanitization led to command injection or arbitrary file access. The trend towards simplifying container management through web UIs, while beneficial for usability, introduces new attack surfaces that must be rigorously secured. This CVE serves as a stark reminder that convenience should never come at the expense of fundamental security principles. Practitioners using Dockge should prioritize immediate action. The most critical step is to update Dockge to a patched version as soon as it becomes available. In the interim, if updating is not immediately feasible, organizations should ensure that Dockge instances are not exposed to untrusted networks and that authentication is strictly enforced. The article notes that instances configured with `disableAuth` expose both read and delete operations without any authentication, making them extremely vulnerable. Reviewing and hardening egress firewall rules to restrict Dockge's outbound access can also limit the impact of potential data exfiltration. Furthermore, adopting a defense-in-depth strategy, including regular security audits of all management interfaces and implementing robust secrets management solutions that minimize the exposure of credentials in `.env` files, is crucial. This event underscores the need for continuous vigilance in securing the entire DevOps toolchain, especially components that interact directly with underlying infrastructure.