CVE-2026-126321

HighCVSS 8.3/10Last modified Nov 13, 2026

Description

Dockhand before 1.0.55 contains a path traversal vulnerability that allows authenticated users with stacks:edit to bypass the file-browser path guard by combining symlinks with '..' sequences. Attackers can read /proc/self/environ, the SQLite database, and the encryption key via /api/system/files/content, or move them using the stack relocate endpoint, exposing stored credentials.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

Weakness enumeration

CWE-22

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Finsys	dockhand	< 1.0.55

References

Timeline

Published: Nov 13, 2026
Last modified: Nov 13, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-1263228.1OpenEMR before 8.3.0 contains an unsanitized deserialization vulnerability that allows authenticated attackers to control patient-matching c CVE-2026-1263234.3Vvveb through 1.0.8.6 contains a cross-site request forgery vulnerability that allows attackers to perform admin state-changing actions beca CVE-2026-1263259.0A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited CVE-2026-126326Improper access control in the administrative role assignment endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated CVE-2026-126327Improper access control in the connection history in Devolutions Server 2026.3.13.0 allows an authenticated user without the permission to v CVE-2026-126328Insertion of sensitive information into sent data in the user endpoints in Devolutions Server 2026.3.13.0 and earlier allows an authenticate CVE-2026-1263297.3Docker Sandboxes reuses existing state and configuration directories without verifying their ownership. If sbx or sandboxd is run as root wi CVE-2026-126338.1The IPv6 neighbor-discovery code in subsys/net/ip/ipv6_nbr.c processes the 6LoWPAN Context Option (6CO, RFC 6775) carried inside ICMPv6 Rout CVE-2026-1263302.4Docker Sandboxes can silently republish a sandbox service after an operator removes its automatically assigned host-port mapping. The daemon CVE-2026-126331Insertion of sensitive information into sent data in the user list endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenti CVE-2026-126332Improper access control in the autofill vault search in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only vi CVE-2026-126345.3The NVS backend of the Zephyr settings subsystem (subsys/settings/src/settings_nvs.c) reads stored setting-name entries into fixed 74-byte s