🔴 CVE-2026-45405

CVSS 评分: 9.0（严重） | 状态: Analyzed | 发布时间: 2026-06-26

漏洞描述

Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:from-archive and certs:add commands extract user-supplied tar/zip archives into temporary directories without sanitizing member paths or preventing symlink traversal. GNU tar creates symlinks during extraction and follows them for subsequent entries, allowing an attacker to write arbitrary files anywhere writable by the dokku user — including overwriting ~/.ssh/authorized_keys to gain unrestricted shell access. This vulnerability is fixed in 0.38.2.

漏洞详情

字段 值
CVE ID CVE-2026-45405
CVSS 评分 9.0（严重）
CVSS 向量 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CWE CWE-59
发布时间 2026-06-26
最后更新 2026-06-26
状态 Analyzed
数据来源 security-advisories@github.com

参考链接

🤖 本文由 CVE 安全快讯机器人自动生成
数据来源: NVD (National Vulnerability Database) | 获取时间: 2026-06-27 03:07