CVE-2026-102332
Dozzle before 11.1.2 Path Traversal via Log ZIP Download
- State
- Published
- Severity
- 4.6 Medium
- Published
- Sep 28, 2026
- Updated
- Oct 1, 2026
- Reserved
- Sep 28, 2026
Description
Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive entry names in the log download endpoint. Attackers who can label containers can use path traversal sequences to write files outside the extraction directory when users download and extract logs.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.6 Medium | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N | VulnCheck |
| 3.1 | 6.1 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N | VulnCheck |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
dozzleamir20 |
|
References
- https://github.com/amir20/dozzle/pull/5242patchissue-tracking
- https://github.com/amir20/dozzle/commit/bc07db73dd84ce2cb939b744e983a8cfdf29c644patch
- dozzle v11.1.2 Release Notesrelease-notes
- https://github.com/amir20/dozzle/blob/v11.1.1/internal/web/download.go#L141-L146technical-description
- https://github.com/amir20/dozzle/blob/v11.1.1/internal/container/docker/client.go#L610-L614technical-description
- https://github.com/amir20/dozzleproduct
- VulnCheck Advisory: Dozzle before 11.1.2 Path Traversal via Log ZIP Downloadthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.