A vulnerability was found in Laradock up to 20.4. (CVE-2026-105137)

CVE-2026-105137 affects Laradock versions up to 20.4 in the workspace/Dockerfile build process. The vulnerability involves downloading code without integrity checks, which could allow an attacker to introduce malicious code remotely. The attack complexity is high, requiring user interaction, and the exploit has been made public. No vendor response or patch is currently available. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L, reflecting network attack vector, high complexity, no privileges required, user interaction required, unchanged scope, and low impact on confidentiality, integrity, and availability.

The vulnerability allows remote attackers to cause Laradock to download code without verifying its integrity, potentially leading to the introduction of malicious code. However, exploitation is difficult due to high complexity and requires user interaction. The impact on confidentiality, integrity, and availability is low. No known exploits are currently observed in the wild.

No official fix or patch is currently available from the vendor, who has not responded to the disclosure. Users should exercise caution when using affected versions and avoid executing untrusted code or Dockerfiles. Monitor vendor channels for any future updates or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.