Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:from-archive and certs:add commands extract user-supplied tar/zip archives into temporary directories without sanitizing member paths or preventing symlink traversal. GNU tar creates symlinks during extraction and follows them for subsequent entries, allowing an attacker to write arbitrary files anywhere writable by the dokku user — including overwriting ~/.ssh/authorized_keys to gain unrestricted shell access. This vulnerability is fixed in 0.38.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-26 | 1 | Disclosure1 |
| 2026-06-27 | 2 | Patch2 |
CVE-2026-45405 Arbitrary File Write via Symlink Traversal in Dokku Prior to 0.38.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45405
Post summary
The text announces CVE-2026-45405 as an arbitrary file write vulnerability through symlink traversal in Dokku versions before 0.38.2, offering technical details but no evidence of exploits, patch, or active use.
🚨 CRITICAL - Dokku archive extraction path traversal & symlink overwrite (CVE-2026-45405) Dokku versions prior to 0.38.2 improperly extract user-supplied tar/zip archives in the git:from-archive and certs:add commands without sanitizing file paths or blocking symlink traversal. The root cause is a path traversal/symlink-following flaw during archive extraction (GNU tar can create symlinks and later entries can write through them). An attacker can exploit this by providing a crafted archive that includes symlinks and traversal paths, requiring only the ability to invoke these Dokku commands or supply an archive to a privileged operator/automation. Impact is arbitrary file write as the dokku user, including overwriting ~/.ssh/authorized_keys to gain persistent shell access and potentially pivot further. 👉 Affected: dokku < 0.38.2 | Upgrade to 0.38.2
Post summary
The post discloses a critical Dokku directory traversal vulnerability that permits arbitrary file writes and urges users to upgrade to version 0.38.2 for patching.
🚨 CRITICAL: CVE-2026-45405 in Dokku (CVSS 9.0) Path traversal in git:from-archive & certs:add commands allows arbitrary file writes, including SSH key overwrites for shell access. Affected: <0.38.2 Patch: Upgrade to 0.38.2 #CVE #Vulnerability #PatchNow https://t.co/UjJLAYsWK2
Post summary
The post alerts users to a critical path‑traversal flaw in Dokku (CVE-2026-45405) and recommends an immediate upgrade to version 0.38.2 as the fix.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | dokku | dokku | - | - | - |