EUVD-2025-210895
GHSA-vmr6-g39x-qp82
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Path traversal via compose file needs no timing or preparation beyond write access; AC:L is appropriate; no availability impact applies.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
Zettlab D6 Ultra before 1.7.0 allows mounting /etc/passwd and /etc/shadow in a container via ".." manipulations such as volumes: - ../../../../../../../etc:/h_etc:rw in a compose file.
AnalysisAI
Path traversal in Zettlab D6 Ultra NAS (versions before 1.7.0) permits a low-privileged local user to mount arbitrary host paths - including /etc/passwd and /etc/shadow - into a container with read-write access by embedding '../' sequences in Docker Compose volume declarations. An attacker with compose-file write privileges can exfiltrate password hashes or overwrite authentication files, enabling full host privilege escalation. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; version 1.7.0 resolves the issue.
Technical ContextAI
The root cause is CWE-24 (Path Traversal: '../filedir'): the D6 Ultra's Docker Compose processing layer fails to canonicalize or reject volume source paths containing '..' components before passing them to the container runtime. Docker Engine accepts arbitrary host paths in volume declarations, so if the NAS management interface does not strip traversal sequences, a declaration such as 'volumes: - ../../../../../../../etc:/h_etc:rw' causes the host /etc directory to be bind-mounted inside the container. The CVSS vector (AV:L/AC:H/PR:L) confirms exploitation is local, requires low-level privileges such as compose-file write access, and the assigned complexity of High may reflect environment-specific gating (e.g., feature must be enabled). The CPE field (cpe:2.3:a:n/a:n/a) is a placeholder and provides no actionable product mapping; affected product identity is sourced entirely from the description text.
RemediationAI
Upgrade Zettlab D6 Ultra to version 1.7.0 or later, which is the vendor-confirmed fix version per the CVE description. If immediate patching is not possible, restrict compose-file creation and modification privileges exclusively to trusted administrative accounts, eliminating the low-privileged user attack path identified in the CVSS PR:L rating. As an additional compensating control, deploy a Docker daemon authorization plugin or seccomp/AppArmor profile that rejects bind-mount paths outside a designated data directory (e.g., /volume1, /opt/zettlab), preventing traversal to /etc regardless of compose content. Note that restricting compose access may interrupt legitimate containerized workloads. No vendor advisory URL was available in the provided references; consult Zettlab's official release notes or update mechanism for patch distribution details.
Same weakness CWE-24 – Path Traversal: '../filedir'
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today