Which versions of Dockge are affected by CVE-2026-73040?

Dockge, a Docker container management platform, contains an authenticated path traversal vulnerability (CVSS 8.7) that allows authorized users to access and exfiltrate secrets from any location the…

How to fix or mitigate CVE-2026-73040?

Within 24 hours: immediately audit all Dockge installations in production and restrict authentication access to a minimal set of trusted administrators; review access logs for suspicious file access or deletion patterns. Within 7 days: implement network segmentation to isolate Dockge from sensitive systems; apply OS-level filesystem permissions to restrict access to directories containing secrets, and deploy activity monitoring on Dockge instances to detect exploit attempts. Within 30 days: evaluate Dockge alternatives or prepare rapid deployment procedures for patched versions when available; migrate secrets from .env files to dedicated secrets management systems (HashiCorp Vault, AWS Secrets Manager, or equivalent); and establish incident response procedures for potential credential compromise.

Dockge CVE-2026-73040

Q: What is the CVSS score of CVE-2026-73040?

CVE-2026-73040 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-63588 HIGH

Path Traversal (CWE-22)

2026-08-20 VulnCheck

GHSA-r5ph-2fqc-qvf3

Docker Path Traversal Dockge

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Network-accessible via WebSocket requiring only user-level auth; scope changes because other host applications' secrets and directories are read and destroyed beyond Dockge's own component.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 20, 2026 - 21:07 vuln.today

CVE Published

Aug 20, 2026 - 20:29 cve.org

HIGH 8.7

DescriptionCVE.org

Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate(), which requires the name to match ^[a-z0-9_-]+$, is reached from save() alone, while the path getter returns path.join(this.server.stacksDir, this.name) and Stack.getStack builds path.join(server.stacksDir, stackName) with no check. The socket handlers in backend/agent-socket-handlers/docker-socket-handler.ts confirm the caller is logged in and that the name is a string, then pass it straight to Stack.getStack, so a name containing traversal sequences resolves outside the managed stacks directory. An authenticated user can therefore read the composeENV and composeYAML values of any directory the server process can reach, which discloses the secrets in that directory's .env or Compose file, and can invoke delete(), which runs docker compose down and then fsAsync.rm on the traversed path with recursive and force set, removing that directory. Disclosure is limited to files named .env or an accepted Compose filename, and deletion requires the target directory to hold a valid Compose file so that docker compose down exits successfully. Dockge commonly runs as root with access to the Docker socket, so the reachable set includes unrelated applications on the host. Instances configured with disableAuth, a supported option that logs the caller in as admin automatically, expose both operations without authentication.

Articles & Coverage 1

News 3 New Docker Vulnerabilities - 3 High Severity, 1 With POC Aug 21, 2026

AnalysisAI

Path traversal in Dockge's stack name handling allows authenticated users to exfiltrate secrets from .env and Compose files belonging to any directory the server process can reach, and to recursively delete those directories. The flaw exists because validate() - which enforces a strict name allowlist - is only called from the save() code path; the socket handlers that service read and delete operations pass the raw user-supplied name directly to Stack.getStack without sanitization. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate to Dockge WebSocket interface

Delivery

Craft stack operation request with traversal name (e.g. ../../../opt/targetapp)

Exploit

Stack.getStack resolves path outside managed stacks directory

Execution

Read returned composeENV or composeYAML to extract secrets

Impact

Optionally invoke delete to trigger docker compose down then recursive forced directory removal