Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Finsys dockhand 1.0.54 Clear all filters
TI-2026-84331 CVE-2026-121449 · GHSA-vvw2-c8c7-h7pp

Secret disclosure in Dockhand via Git stack webhook

Priority MEDIUM 64

Dockhand from 1.0.47 before 1.0.54 exposes plaintext stack secrets because deployStack() attaches resolved secret values to its result as resolvedSecrets, which Git-stack routes return unfiltered.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00404 Published 2026-11-03 Fixed in 1.0.54 CWE-200
TI-2026-84330 CVE-2026-121448 · GHSA-9vvm-xvr2-mhx6

Path traversal in Dockhand lets users access .env files outside stacks root

Priority MEDIUM 40

Dockhand before 1.0.54 contains a path traversal vulnerability that allows authenticated users to read, overwrite, and delete .env files outside the stacks root by double-encoding the stack name.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00478 Published 2026-11-03 Fixed in 1.0.54 CWE-22