CVE-2026-121448

Dockhand before 1.0.54 contains a path traversal vulnerability that allows authenticated users to read, overwrite, and delete .env files outside the stacks root by double-encoding the stack name. Attackers can send %252e%252e sequences to /api/stacks/name/env/raw to disclose cross-environment...

CVE-2026-121448

Dockhand versions prior to 1.0.54 are vulnerable to a path traversal vulnerability (CWE-22) within the stack environment routes. Authenticated users can exploit this by double-encoding the stack name, specifically using %252e%252e sequences in the /api/stacks/[name]/env/raw endpoint. This flaw al...