CVE-2026-73040: dockge 0 through 1.5.0

Affected technology

dockge · 0 through 1.5.0
louislam

Component: Not specified by the source
File: backend/stack.ts, backend/agent-socket-handlers/docker-socket-handler.ts

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated user can therefore read the composeENV and composeYAML values of any directory the server process can reach, which discloses the secrets in that directory's .env or Compose file, and can invoke delete(), which runs docker compose down and then fsAsync.rm on the traversed path with recursive and force set, removing that directory. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality, integrity and availability impact as high.