CVE-2026-113354
MEDIUM
CVSS 6.5
Published: 2026-10-20
Modified: 2026-10-20
Tenable Plugin
Checking the public Tenable catalog…
Threat Intelligence Pending
IOCs, MITRE ATT&CK techniques, and attack chain data are being generated. Refresh in a few seconds.
Description
Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, and SSH keys from the Dockhand container.
Quick Facts
| CVE ID | CVE-2026-113354 |
| CVSS Score | 6.5 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| Published | 2026-10-20 |
| Exploited | No |
| CISA KEV | No |
| PoC | Not public |
References
- https://github.com/Finsys/dockhand/blob/5adb374c0d79c8df0f85…
- https://github.com/Finsys/dockhand/commit/5af4e69eb20bde4b84…
- https://github.com/Finsys/dockhand/releases/tag/v1.0.46
- https://github.com/Finsys/dockhand/security/advisories/GHSA-…
- https://www.vulncheck.com/advisories/dockhand-before-1.0.46-…