CVE-2026-105137: Download of Code Without Integrity Check in Laradock
Description
A vulnerability was found in Laradock up to 20.4. Impacted is an unknown function of the file workspace/Dockerfile of the component Build Process. The manipulation results in download of code without integrity check. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0
Score 2.3low
Affected software
Laradock
pkg:github/s4hilpuni4/laradockcpe:2.3:a:laradock:laradock:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Laradock up to version 20.4 affects an unspecified function in the workspace/Dockerfile build process component. It allows remote attackers to cause the system to download code without verifying its integrity, potentially leading to the execution of untrusted code. The attack complexity is high, and exploitation requires user interaction. Although exploit code has been publicly disclosed, no known exploitation in the wild has been reported. The vendor was contacted but did not provide any response or remediation guidance.
Potential Impact
The vulnerability permits remote attackers to download code without integrity verification, which could lead to the execution of malicious code if exploited. However, the attack complexity is high, and user interaction is required, reducing the likelihood of successful exploitation. The CVSS score of 2.3 reflects a low overall impact.
Mitigation Recommendations
No official patch or remediation guidance has been provided by the vendor. Users should monitor the vendor's communications for any updates. Until a fix is available, cautious use of affected Laradock versions is advised, especially avoiding untrusted sources during the build process.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-10-03T13:24:26.683Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac214bbf6d3684c3ce76aea
Added to database: 10/04/2026, 08:56:27 UTC
Last enriched: 10/04/2026, 09:08:37 UTC
Last updated: 10/04/2026, 09:38:09 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.