CVE-2026-45405

Katalog CVE

CVSS 8.8 · High EPSS 0,46%

Kerentanan Improper Link Resolution Before File Access ('Link Following') pada dokku. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:from-archive and certs:add commands extract user-supplied tar/zip archives into temporary directories without sanitizing member paths or preventing symlink traversal. GNU tar creates symlinks during extraction and follows them for subsequent entries, allowing an attacker to write arbitrary files anywhere writable by the dokku user — including overwriting ~/.ssh/authorized_keys to gain unrestricted shell access. This vulnerability is fixed in 0.38.2.

Rincian

Terbit di NVD

26 Juni 2026

Terakhir diubah

26 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 37,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/dokku/dokku/security/advisories/GHSA-j6qq-xg73-ghqg advisory vendor
• https://github.com/dokku/dokku/pull/8591 issue tracking · patch