An authenticated path traversal vulnerability in louislam Dockge versions 1.5.0 and earlier allows attackers to perform unauthorized file operations and directory deletions.

The application fails to properly validate stack names on the write path, leading to a path traversal vulnerability (CWE-22). This allows an authenticated user with low privileges to manipulate file paths, resulting in arbitrary file disclosure and directory deletion.

The ability to read arbitrary files and delete directories poses a severe risk to system integrity and confidentiality. An attacker could extract sensitive configuration files or environment variables, potentially leading to a full system compromise. With a CVSS score of 8.8, this vulnerability represents a high risk that requires immediate attention to prevent unauthorized data access or service disruption.

Immediate Action: Monitor the official repository for a patched version release and apply it immediately upon availability.

Proactive Monitoring: Review application access logs for suspicious stack naming patterns or attempts to access restricted directory paths.

Compensating Controls: Implement strict network segmentation and ensure that the Dockge instance runs with the minimum necessary filesystem permissions to limit the impact of a successful traversal.

Public Exploit Available: Unknown

Given the high severity of this path traversal flaw, administrators should prioritize the deployment of security patches once released by the vendor. Until a fix is available, restrict access to the Dockge interface to trusted users only and enforce the principle of least privilege regarding the service account running the software.