Dockge: authenticated user reads or deletes arbitrary host directories via stack-name traversal

Impact

Dockge manages Docker Compose stacks from a web UI and typically runs as root with the Docker socket mounted, so its reach is the whole host. The allow-list on stack names is only enforced on the write path; Stack.getStack joins the caller-supplied name into stacksDir with no check, so a name containing traversal sequences resolves outside the managed directory. An authenticated user can read the .env or Compose file of any directory the process can reach - disclosing the secrets of unrelated applications on the same node - and can call delete(), which runs docker compose down and then a recursive force remove on the traversed path. On a node also hosting GPU workload stacks that means reading another team's model-registry or cloud credentials, and destroying their deployment directory. Instances started with the supported disableAuth option expose both operations with no authentication at all.

Who can reach it

Any logged-in Dockge user over the web/socket interface; no authentication at all when the instance runs with disableAuth. Deletion additionally requires the target directory to contain a valid Compose file.

What to do

No fixed version is named in the record - the references point only at the vulnerable 1.5.0 code paths. Treat as mitigate-only for now: do not expose Dockge beyond trusted operators, never run it with disableAuth, confine stacksDir by running Dockge in a container that mounts only that directory rather than the host root, and drop it from nodes where it is not needed. Removing or restricting the service is a daemon-level change, not a node reboot.

References

Related entries

• NGINX Ingress Controller: unsanitized Ingress annotations inject arbitrary NGINX directivesCVE-2026-77180 · NGINX Ingress Controller (Ingress annotation to nginx.conf generator)High
• Nuclio dashboard: namespace headers reach /bin/sh unquoted on the list-all path, unauthenticated RCECVE-2026-79756 · Nuclio dashboard (local/Docker platform, list-all resource path)High
• Docker Sandboxes: symlink race in the socket relay lets a guest reach arbitrary host AF_UNIX socketsCVE-2026-79994 · Docker Sandboxes (guest-to-host Unix-domain socket relay)High
• Coolify: shell metacharacters in env var keys give command execution on managed server hostsCVE-2026-84694 · Coolify (environment variable key names in Docker commands run over SSH)High
• NGINX Ingress Controller: spoofable forwarded headers bypass external authenticationCVE-2026-94197 · F5 NGINX Kubernetes Ingress Controller (ExternalAuth / auth_request subrequest)High
• runc: Host runc binary overwritten from inside a containerCVE-2019-5736 · runcHigh