CVE-2026-73040: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in louislam dockge

Dockge improperly limits pathname access to a restricted directory due to insufficient validation of stack names on read and delete paths. While the save() function validates stack names against an allow-list regex, other code paths such as Stack.getStack and socket handlers do not enforce this validation, allowing path traversal sequences in stack names. Authenticated users can exploit this to read .env and Compose files outside the intended stacks directory, disclosing secrets, and can delete directories containing valid Compose files by invoking docker compose down and recursive removal. The vulnerability is exacerbated by dockge commonly running as root with Docker socket access, increasing the impact scope. Instances configured with disableAuth option expose these operations without authentication.

An authenticated user with at least low privileges can read sensitive environment and Compose files outside the intended directory, potentially disclosing secrets. They can also delete directories containing valid Compose files, causing denial of service or disruption to unrelated applications on the host. Since dockge often runs as root with Docker socket access, the attacker’s reach includes critical system and application files. Instances with disabled authentication allow unauthenticated attackers to perform these actions, increasing risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid running dockge with the disableAuth option enabled to prevent unauthenticated access. Limit dockge's privileges and Docker socket access where possible to reduce impact. Monitor for updates from the vendor regarding an official fix.