What is the CVSS score of EUVD-2026-39804?

EUVD-2026-39804 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Dokku are affected by EUVD-2026-39804?

Dokku versions before 0.38.2 contain an arbitrary file write vulnerability that allows attackers with deploy-level credentials to escalate privileges to complete host control.. A patch is available.

How to fix or mitigate EUVD-2026-39804?

Within 24 hours: Identify all Dokku instances and current versions; restrict deploy-level access to essential administrators and automated systems only; review access logs for unauthorized activity. Within 7 days: Upgrade all Dokku deployments to version 0.38.2 or later. Within 30 days: Audit all Dokku hosts for unauthorized SSH keys in ~/.ssh/authorized_keys files, review file integrity in critical system directories, and assess whether unauthorized privilege escalations occurred.

Dokku EUVD-2026-39804

| CVE-2026-45405 HIGH

Improper Link Resolution Before File Access (CWE-59)

2026-06-26 GitHub_M

Information Disclosure Docker Dokku

8.8

CVSS 3.1 · NVD

Severity by source

Vendor (GitHub_M) PRIMARY

CRITICAL

qualitative

NVD

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Attacker needs deploy/cert command access so PR:L; archive can be remotely supplied (AV:N), extraction is deterministic (AC:L), and arbitrary file write to authorized_keys yields full C/I/A.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 26, 2026 - 19:15 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 26, 2026 - 19:14 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 26, 2026 - 19:07 vuln.today

cvss_changed

Severity Changed

Jun 26, 2026 - 19:07 NVD

CRITICAL HIGH

CVSS changed

Jun 26, 2026 - 19:07 NVD

9.0 (CRITICAL) 8.8 (HIGH)

Patch available

Jun 26, 2026 - 18:02 EUVD

Source Code Evidence Fetched

Jun 26, 2026 - 17:26 vuln.today

Analysis Generated

Jun 26, 2026 - 17:26 vuln.today

DescriptionNVD

Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:from-archive and certs:add commands extract user-supplied tar/zip archives into temporary directories without sanitizing member paths or preventing symlink traversal. GNU tar creates symlinks during extraction and follows them for subsequent entries, allowing an attacker to write arbitrary files anywhere writable by the dokku user - including overwriting ~/.ssh/authorized_keys to gain unrestricted shell access. This vulnerability is fixed in 0.38.2.

Articles & Coverage 1

News Critical Arbitrary File Write in Dokku PaaS before 0.38.2 - CVE-2026-45405 Jun 26, 2026

AnalysisAI

Arbitrary file write in Dokku before 0.38.2 lets an attacker with deploy-level access escalate to full shell access on the host. The git:from-archive and certs:add commands extract attacker-supplied tar/zip archives without sanitizing member paths, and because GNU tar creates and then follows symlinks during extraction, a crafted archive can plant files anywhere the dokku user can write - most damagingly ~/.ssh/authorized_keys. There is no public exploit identified at time of analysis and CISA SSVC records exploitation as none, but the technical impact is rated total.

Technical ContextAI

Dokku is a Docker-powered, self-hosted PaaS (Heroku-style) that lets users deploy apps and manage TLS certificates via shell-style subcommands. The affected workflows are git:from-archive (deploy from a tar/zip) and certs:add (load a certificate bundle), both of which pipe a user-supplied archive into GNU tar for extraction into a temporary directory. The root cause is CWE-59 (link following / improper link resolution): tar materializes symlink entries as it extracts and then writes subsequent entries through those links. By ordering an archive so an early entry creates a symlink pointing outside the temp directory (e.g. to the dokku user's home) and a later entry writes through that link, the extraction escapes its intended directory. CPE cpe:2.3:a:dokku:dokku confirms the dokku application itself is the affected component; the fix (PR #8591) adds a pre-extraction validator that rejects absolute paths, .. traversal, and out-of-tree symlinks, plus archive-bomb limits (archive-max-size, archive-max-files).

RemediationAI

Vendor-released patch: upgrade to Dokku 0.38.2 or later, which validates archives before extraction and rejects absolute paths, parent-directory (..) traversal, and symlinks pointing outside the extraction directory, as documented in GHSA-j6qq-xg73-ghqg and PR #8591. Until you can upgrade, restrict who can run git:from-archive and certs:add and never feed untrusted or externally-fetched archives to these commands, since exploitation depends on supplying a malicious archive; treat deploy/cert access as equivalent to host shell access. After patching you can also tune the new safety limits via dokku git:set --global archive-max-size and archive-max-files (defaults 1 GiB and 10000 entries) to constrain archive-bomb abuse, noting that overly tight values may reject legitimate large deployments. Review ~/.ssh/authorized_keys and other files writable by the dokku user for unexpected modifications, as this is the documented escalation target.