CVE-2026-126321
HIGH
NVD
CVSS Score
8.3
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
Dockhand before 1.0.55 contains a path traversal vulnerability that allows authenticated users with stacks:edit to bypass the file-browser path guard by combining symlinks with '..' sequences. Attackers can read /proc/self/environ, the SQLite database, and the encryption key via /api/system/files/content, or move them using the stack relocate endpoint, exposing stored credentials.