Laradock Build Process Dockerfile code download
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-494.
Summary
A vulnerability was found in Laradock up to 20.4. Impacted is an unknown function of the file workspace/Dockerfile of the component Build Process. The manipulation results in download of code without integrity check. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The exploit has been made public and could be used. Upgrading to version 20.5 is recommended to address this issue. The patch is identified as c3494f432668472056aa0a9134ff4e0d9d2e8cea. You should upgrade the affected component. The vendor confirms: "The fix replaces the reported plaintext Event and New Relic downloads with HTTPS-only downloads and checks pinned SHA-256 hashes before extracting the archives. We also fixed the Event download in the PHP-FPM Dockerfile, in addition to the locations you identified."
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Laradock | 20.0; 20.1; 20.2; 20.3; 20.4 | 20.5 | Patch available | CNA |
- Laradock Vendor— Affected 20.0; 20.1; 20.2; 20.3; 20.4 Fixed in 20.5 Patch available CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:laradock:laradock:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:laradock:laradock:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
- Fix · CNA Laradock Fixed in 20.5
Timeline
- 2026-10-04 Threatist record created from CVE-2026-105137
- 2026-10-04 Alias added: GHSA-r2hw-g35f-pfw5
- 2026-10-05 CISA SSVC decision points changed
- 2026-10-05 Priority changed: LOW → MEDIUM
- 2026-11-07 CVSS score changed · CNA
- 2026-11-07 Fix available: n/a/[email protected] · CNA
- 2026-11-07 4 new references · CNA
References
Patch 3
Sources
- CVE-2026-105137 · CVE Program
- CVE-2026-105137 · NVD
- FIRST EPSS
- GHSA-r2hw-g35f-pfw5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences