CVE-2026-105137
Laradock Build Process Dockerfile code download
- State
- Published
- Severity
- 2.3 Low
- Published
- Oct 4, 2026
- Updated
- Oct 5, 2026
- Reserved
- Oct 3, 2026
Description
A vulnerability was found in Laradock up to 20.4. Impacted is an unknown function of the file workspace/Dockerfile of the component Build Process. The manipulation results in download of code without integrity check. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.3 Low | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 5.0 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C | VulDB |
| 3.0 | 5.0 Medium | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C | VulDB |
| 2.0 | 5.1 Medium | AV:N/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C | VulDB |
Weaknesses
- CWE-494 Download of Code Without Integrity Check
Affected Products
| Product | Versions |
|---|---|
Laradockn/a |
|
References
- VDB-413353 | Laradock Build Process Dockerfile code downloadvdb-entry
- VDB-413353 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-105137 | CVE Analysis and Reportthird-party-advisory
- Submit #944355 | laradock v20.4 Download of Code Without Integrity Checkthird-party-advisory
- https://github.com/s4hilpuni4/laradock_build_time_rce_http_download.gitexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.