Dockhand EUVD-2026-115870

Requires a valid authenticated Dockhand session - unauthenticated requests return 401 and are not exploitable. The attacker must send a double-URL-encoded traversal sequence (e.g. %252e%252e, which SvelteKit decodes once and the route's extra decodeURIComponent decodes again to '..') as the stack name to the stack-environment routes GET/PUT /api/stacks/[name]/env/raw (and ~18 sibling routes: env, deploy, down, start, stop, restart, validate, deploys, auto-update/[containerName]). An empty/whitespace content body on PUT triggers the delete (rmSync) primitive. No non-default configuration is needed - the flaw affects default deployments of both Community and Enterprise editions. Limiting factors: in Community Edition every authenticated user is already admin so the privilege boundary crossed is mainly the fs-guard filesystem invariant; the cross-tenant impact applies specifically to Enterprise RBAC multi-environment tenancy, where the env query parameter is trusted and lets a user scoped to one environment reach another's .env files.

Severity signals are moderately high but qualified by an authentication requirement. The supplied CVSS 4.0 base score is 8.7 with AV:N/AC:L/AT:N/PR:L/UI:N and VC:H/VI:H/VA:L - network-reachable, low complexity, but PR:L means a valid authenticated session is mandatory (the advisory confirms unauthenticated requests are correctly rejected with 401). No EPSS score was provided and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation - do not treat this as in-the-wild. However, the vuln.today decision label is 'this_week' and a detailed, runtime-verified proof-of-concept is published in the GHSA advisory, so this is a genuine, near-term patching priority rather than a high-CVSS-but-theoretical issue. A key nuance: in the Community Edition every authenticated user already holds admin, so the marginal privilege gain there is small; the real impact teeth are in Enterprise RBAC tenancy (the environment-scoping gate is bypassed, enabling cross-tenant secret disclosure) and in violating the documented fs-guard invariant on /app/data/db - but the advisory notes only the CE image was runtime-verified while the Enterprise RBAC layer was assessed from the shared public source tree, so cross-tenant impact is confirmed at code level but not runtime-demonstrated.

An authenticated Dockhand user sends a PUT to /api/stacks/%252e%252e/env/raw; the server double-decodes the name to '..' and writes or reads an .env file outside the managed stacks root, including the fs-guard-protected /app/data/db directory. The attacker reads another environment's .env to steal database credentials and API keys, or poisons a stack's .env so the next normal deployment interpolates an attacker-controlled value into a running container. A verified public proof-of-concept with working curl reproduction is published in the GHSA advisory.