Description

Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate(), which requires the name to match ^[a-z0-9_-]+$, is reached from save() alone, while the path getter returns path.join(this.server.stacksDir, this.name) and Stack.getStack builds path.join(server.stacksDir, stackName) with no check. The socket handlers in backend/agent-socket-handlers/docker-socket-handler.ts confirm the caller is logged in and that the name is a string, then pass it straight to Stack.getStack, so a name containing traversal sequences resolves outside the managed stacks directory. An authenticated user can therefore read the composeENV and composeYAML values of any directory the server process can reach, which discloses the secrets in that directory's .env or Compose file, and can invoke delete(), which runs docker compose down and then fsAsync.rm on the traversed path with recursive and force set, removing that directory. Disclosure is limited to files named .env or an accepted Compose filename, and deletion requires the target directory to hold a valid Compose file so that docker compose down exits successfully. Dockge commonly runs as root with access to the Docker socket, so the reachable set includes unrelated applications on the host. Instances configured with disableAuth, a supported option that logs the caller in as admin automatically, expose both operations without authentication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-20T21:17:09.110Z",
  "pubdate": "2026-08-20T21:17:09.110Z",
  "executiveSummary": "Dockge suffers from a path traversal vulnerability that enables authenticated or unauthenticated users (when disableAuth is configured) to perform arbitrary file disclosure and arbitrary directory deletion on the host system.\nThe vulnerability type is improper input validation leading to path traversal, allowing attackers to access files and directories outside the designated stacks directory.\nThe affected product is Dockge, which commonly executes with root privileges and direct access to the Docker socket.\nThe risk implications are severe, as an attacker can read sensitive environment variables or configuration files such as .env and Compose files from unrelated applications on the host, and forcefully delete arbitrary directories that contain a valid Compose file.\nAttacker capabilities include reading targeted files and executing destructive file system removal via recursive and forced deletion.\nExploitation requirements include authentication (unless disableAuth is enabled) and the ability to supply directory traversal sequences within the stack name parameter, with deletion requiring the target directory to house a valid Compose file for docker compose down to succeed.",
  "technicalDetails": "The vulnerability stems from inconsistent input validation across the write and read paths within Dockge. Specifically, in backend/stack.ts, the allow-list validation checking for the regular expression ^[a-z0-9_-]+$ is exclusively enforced within the save() function via the validate() method.\nThe path resolution logic within the path getter (returning path.join(this.server.stacksDir, this.name)) and the Stack.getStack method (building path.join(server.stacksDir, stackName)) lack any input validation or sanitization, failing to restrict stack names to the managed stacks directory.\nSocket handlers located in backend/agent-socket-handlers/docker-socket-handler.ts verify only that a caller is logged in and that the supplied name is a string, passing the untrusted input directly to Stack.getStack without further checks.\nConsequently, supplying traversal sequences within the stack name parameter allows it to resolve outside the intended base directory.\nAn authenticated user or an unauthenticated user on instances configured with the disableAuth option can exploit this flaw in a step-by-step manner.\nFirst, the attacker passes a stack name containing directory traversal sequences to socket handlers, which invoke Stack.getStack.\nSecond, for information disclosure, the attacker leverages read operations to target composeENV and composeYAML values, exposing secrets stored in .env or accepted Compose filenames within any directory reachable by the server process.\nThird, for destructive impact, the attacker invokes the delete() method, which executes docker compose down followed by fsAsync.rm with recursive and force parameters set on the traversed path, effectively removing the targeted directory from the host.\nBecause Dockge typically runs as root with access to the Docker socket, the reachable target set encompasses unrelated applications and critical paths across the underlying host system."
}