CVE-2026-45405

critical · 9

Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:from-archive and certs:add commands extract user-supplied tar/zip archives into temporary directories without sanitizing member paths or preventing symlink traversal. GNU tar creates symlinks during extraction and follows them for subsequent entries, allowing an attacker to write arbitrary files anywhere writable by the dokku user — including overwriting ~/.ssh/authorized_keys to gain unrestricted shell access. This vulnerability is fixed in 0.38.2.

CVSS

0.5%

EPSS (exploit prob.)

39th

EPSS percentile

2026-06-26

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weaknesses

CWE-59

Affected products

Vendor	Product	Affected versions
dokku	dokku	< 0.38.2

Check a specific version with /api/v1/cve/match.

References

https://github.com/dokku/dokku/pull/8591
https://github.com/dokku/dokku/security/advisories/GHSA-j6qq-xg73-ghqg

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-45405