CVE-2026-45405 Details
Description
Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:from-archive and certs:add commands extract user-supplied tar/zip archives into temporary directories without sanitizing member paths or preventing symlink traversal. GNU tar creates symlinks during extraction and follows them for subsequent entries, allowing an attacker to write arbitrary files anywhere writable by the dokku user — including overwriting ~/.ssh/authorized_keys to gain unrestricted shell access. This vulnerability is fixed in 0.38.2.
A vulnerability in Dokku versions prior to 0.38.2 allows for arbitrary file writing through symlink traversal in the 'git:from-archive' and 'certs:add' commands. These commands extract user-provided tar or zip archives into temporary directories without properly sanitizing file paths or preventing symlink traversal. As a result, an attacker could exploit this behavior to write files to any location writable by the 'dokku' user. This includes the possibility of overwriting the 'authorized_keys' file in the '.ssh' directory, potentially leading to unrestricted shell access.
Users can upgrade to Dokku version 0.38.2 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dokku/dokku/pull/8591 | [email protected] | Issue TrackingPatch |
| https://github.com/dokku/dokku/security/advisories/GHSA-j6qq-xg73-ghqg | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dokku dokku | < 0.38.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | New CVE Received | [email protected] |