Laradock CVE-2026-105137

Exploitation requires that the Laradock workspace/Dockerfile build process fetch code or binaries over the network with no integrity verification (no checksum or signature), and that an attacker can control or intercept that specific download (e.g. network MITM or upstream source compromise). It further requires a user to actually initiate the container build (UI:P), and is rated high complexity/difficult, meaning the attacker must win a timing or positioning race on the fetched resource. These limiting factors - passive user interaction, network-position prerequisite, and build-time-only window - substantially constrain real-world exploitation despite the network attack vector.

This is a low-priority issue despite being remotely launchable. The CVSS 4.0 base score is only 2.3, driven by high attack complexity (AC:H), required passive user interaction (UI:P, i.e. a developer must run the build), and uniformly low impacts (VC:L/VI:L/VA:L). The vendor-provided vector shows E:P (proof-of-concept exploit maturity), consistent with the reported public POC. There is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation. The signals are internally consistent: a publicly available exploit exists, but the flaw is explicitly characterized as difficult to exploit, and realistic abuse requires an attacker to control or intercept the remote resource fetched at build time (classic CWE-494 download-without-integrity-check). Conflicting note: the Tags include 'Information Disclosure,' but CWE-494 and the exploit repository name ('laradock_build_time_rce...') point to a code-integrity/execution weakness rather than disclosure - treat the disclosure framing with caution. Overall this is a genuinely low real-world risk, not a high-CVSS-but-low-impact case; it is simply low across the board.

A developer builds the Laradock workspace container, whose Dockerfile fetches code or binaries over the network without verifying integrity (no checksum/signature). An attacker positioned to intercept or substitute that fetched resource - e.g. via network MITM or compromise of the upstream download source - injects malicious code that executes during the build, yielding low-level compromise of the build environment. A public POC exists (github.com/s4hilpuni4/laradock_build_time_rce_http_download), but high complexity and the need for the developer to actually run the build limit practical exploitation.