Description

Zettlab D6 Ultra before 1.7.0 allows mounting /etc/passwd and /etc/shadow in a container via ".." manipulations such as volumes: - ../../../../../../../etc:/h_etc:rw in a compose file.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-13T19:16:52.850Z",
  "pubdate": "2026-09-13T19:16:52.850Z",
  "executiveSummary": "Zettlab D6 Ultra versions prior to 1.7.0 are susceptible to a critical Path Traversal vulnerability arising from insufficient validation of volume mapping configurations in container deployment files.\nThis vulnerability allows an attacker to escape the designated container context by utilizing '..' (directory traversal) sequences within a compose file volume definition.\nThe flaw permits mounting sensitive host filesystem directories, specifically '/etc/passwd' and '/etc/shadow', directly into a container with read-write ('rw') permissions.\nBy gaining write access to these sensitive host files, an attacker can escalate privileges, create unauthorized users, or modify existing credentials, leading to a complete compromise of the host system's security integrity.\nThe attack requires the ability to define or influence the container's configuration file, typically occurring in environments where users have the authority to deploy containers via compose configurations.\nThe risk is severe as it subverts container isolation mechanisms, allowing for host-level unauthorized access from within the containerized environment.",
  "technicalDetails": "The vulnerability resides in the Zettlab D6 Ultra container orchestration logic, which fails to adequately sanitize path inputs provided in container configuration files, specifically within the volume mapping directive.\nThe root cause is a lack of path validation for volume source paths, enabling the use of dot-dot-slash ('../') sequences to traverse outside the intended root directory into sensitive areas of the host filesystem.\nThe attack flow proceeds as follows: An attacker with the ability to define a container configuration provides a maliciously crafted volume mapping entry, such as 'volumes: - ../../../../../../../etc:/h_etc:rw'. When Zettlab D6 Ultra processes this configuration, the input validation mechanism fails to normalize or restrict the path, interpreting the relative path from the host's perspective.\nConsequently, the host directory '/etc' is mounted into the container at the path '/h_etc' with read-write permissions. This bypasses typical container sandboxing, granting the container process full read and write access to critical host system files.\nOnce the host's '/etc/passwd' and '/etc/shadow' files are mounted, the attacker can manipulate user accounts, reset passwords for existing users, or inject new administrative accounts from within the container.\nThe vulnerability is present in all Zettlab D6 Ultra versions before 1.7.0. It does not require specific network exposure, as the exploitation is facilitated through the configuration definition phase, assuming the attacker has authorized access to deploy containers or modify compose files.\nPost-exploitation, the attacker achieves persistence and privilege escalation on the host OS by modifying user identity data. Because the mount is specified as read-write, the attacker can directly modify configuration files that control system authentication and authorization, rendering host security controls ineffective."
}