Dockhand before 1.0.54 Path Traversal via Stack Environment Routes

Summary

Dockhand before 1.0.54 contains a path traversal vulnerability that allows authenticated users to read, overwrite, and delete .env files outside the stacks root by double-encoding the stack name. Attackers can send %252e%252e sequences to /api/stacks/[name]/env/raw to disclose cross-environment secrets, write into protected directories, or poison deployment variables.

Remediation

1. Inventory every Finsys dockhand deployment, including staging.
2. Upgrade Finsys dockhand to 1.0.54.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://github.com/Finsys/dockhand/security/advisories/GHSA-q2vc-4qcx-2vm6
• Advisoryhttps://www.vulncheck.com/advisories/dockhand-before-1.0.54-path-traversal-via-stack-environment-routes