CVE-2026-102332
Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive…
- Risk score
- 41/100
- CVSS
- 6.1 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 28 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive entry names in the log download endpoint. Attackers who can label containers can use path traversal sequences to write files outside the extraction directory when users download and extract logs.
- Affected
- See advisory
- Fix
- Upgrade the product to 11.1.2 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.1 medium
References
- https://github.com/amir20/dozzle
- https://github.com/amir20/dozzle/blob/v11.1.1/internal/container/docker/client.go#L610-L614
- https://github.com/amir20/dozzle/blob/v11.1.1/internal/web/download.go#L141-L146
- https://github.com/amir20/dozzle/commit/bc07db73dd84ce2cb939b744e983a8cfdf29c644
- https://github.com/amir20/dozzle/pull/5242
- https://github.com/amir20/dozzle/releases/tag/v11.1.2
- https://www.vulncheck.com/advisories/dozzle-before-11.1.2-path-traversal-via-log-zip-download
Original description
Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive entry names in the log download endpoint. Attackers who can label containers can use path traversal sequences to write files outside the extraction directory when users download and extract logs.
Last activity 28 Sep 2026. Patch Forecast updates every hour.