CVE-2026-102332

Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive entry names in the log download endpoint. Attackers who can label containers can use path traversal sequences to write files outside the extraction directory when users download and extract logs.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/amir20/dozzle
https://github.com/amir20/dozzle/blob/v11.1.1/internal/container/docker/client.go#L610-L614
https://github.com/amir20/dozzle/blob/v11.1.1/internal/web/download.go#L141-L146
https://github.com/amir20/dozzle/commit/bc07db73dd84ce2cb939b744e983a8cfdf29c644
https://github.com/amir20/dozzle/pull/5242
https://github.com/amir20/dozzle/releases/tag/v11.1.2
https://www.vulncheck.com/advisories/dozzle-before-11.1.2-path-traversal-via-log-zip-download

Configurations

No configuration.

History

28 Sep 2026, 23:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-28 23:17

Updated : 2026-10-01 16:17

NVD link : CVE-2026-102332

Mitre link : CVE-2026-102332

CVE.ORG link : CVE-2026-102332

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-102332", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102332", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-01T15:09:15.293219Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 1.6}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/amir20/dozzle", "vendor": "amir20", "product": "dozzle", "versions": [{"status": "affected", "version": "8.9.1", "lessThan": "11.1.2", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/amir20/dozzle", "defaultStatus": "unaffected"}]}], "published": "2026-09-28T23:17:01.507", "references": [{"url": "https://github.com/amir20/dozzle", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/amir20/dozzle/blob/v11.1.1/internal/container/docker/client.go#L610-L614", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/amir20/dozzle/blob/v11.1.1/internal/web/download.go#L141-L146", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/amir20/dozzle/commit/bc07db73dd84ce2cb939b744e983a8cfdf29c644", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/amir20/dozzle/pull/5242", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/amir20/dozzle/releases/tag/v11.1.2", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/dozzle-before-11.1.2-path-traversal-via-log-zip-download", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive entry names in the log download endpoint. Attackers who can label containers can use path traversal sequences to write files outside the extraction directory when users download and extract logs."}], "lastModified": "2026-10-01T16:17:34.323", "sourceIdentifier": "disclosure@vulncheck.com"}