Read the docs
TI-2026-76803 Aliases CVE-2026-113354GHSA-j864-cxh9-gqc9

Dockhand Arbitrary File Read via /api/system/files/content

Priority MEDIUM 64CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Dockhand before 1.0.46 from Finsys contains an arbitrary file read flaw caused by incorrect authorization (CWE-863). A non-admin user with stacks:edit permission can read any file on the host by supplying an absolute path to the path parameter of /api/system/files/content. A remote attacker with low privileges and a valid account can read sensitive files such as /etc/shadow and SSH keys from the Dockhand container.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, and SSH keys from the Dockhand container.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00375 31st percentileScored 2026-11-07
Fix Fixed dockhand (Finsys): 1.0.46

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Finsysdockhandbefore 1.0.461.0.46Patch availableCNA
  • dockhand VendorFinsys Affected before 1.0.46 Fixed in 1.0.46 Patch available CNA

Remediation

Update Finsys Dockhand to version 1.0.46 or later, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA dockhand (Finsys) Fixed in 1.0.46

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-113354
  2. 2026-10-20 Alias added: GHSA-j864-cxh9-gqc9
  3. 2026-10-22 Priority changed: MEDIUM → LOW
  4. 2026-10-23 CISA SSVC decision points changed
  5. 2026-10-23 Priority changed: LOW → MEDIUM

References

Patch 1

Advisory 1

Other 2

  • TI-2026-73418 Authentication bypass in Finsys Dockhand via static-asset check CVSS 4.0CRITICAL 10.0
  • TI-2026-73458 Server-side request forgery in Finsys Dockhand template endpoint CVSS 4.0HIGH 8.4
  • TI-2026-84331 Secret disclosure in Dockhand via Git stack webhook CVSS 4.0HIGH 7.1
  • TI-2026-73459 LDAP injection in Dockhand enables username enumeration CVSS 4.0MEDIUM 6.3
  • TI-2026-75363 Unauthenticated command execution in Dockhand container terminal CVSS 3.1CRITICAL 9.6
  • TI-2026-73417 Finsys Dockhand OIDC privilege escalation via missing claim checks CVSS 4.0CRITICAL 9.2
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences