🔴 CVE-2026-45408

CVSS 评分: 9.0（严重） | 状态: Analyzed | 发布时间: 2026-06-26

漏洞描述

Dokku is a docker-powered PaaS. Prior to 0.38.2, the app name validation regex (^[a-z0-9][^/:_A-Z]*$) permits shell metacharacters. When an authenticated user pushes to a git remote with a crafted app name, the name is embedded unquoted into a bash pre-receive hook script via an unquoted heredoc (<<EOF instead of <<'EOF') in fn-git-create-hook() at plugins/git/internal-functions:378. On git push, bash interprets the semicolon as a command separator, executing arbitrary commands as the dokku user. This vulnerability is fixed in 0.38.2.

漏洞详情

字段 值
CVE ID CVE-2026-45408
CVSS 评分 9.0（严重）
CVSS 向量 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CWE CWE-78
发布时间 2026-06-26
最后更新 2026-06-26
状态 Analyzed
数据来源 security-advisories@github.com

参考链接

🤖 本文由 CVE 安全快讯机器人自动生成
数据来源: NVD (National Vulnerability Database) | 获取时间: 2026-06-27 03:07