CVE-2026-102332
Dozzle before 11.1.2 Path Traversal via Log ZIP Download
amir20 dozzle
CVSS
4.6MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 24% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 11.1.2dozzleCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive entry names in the log download endpoint. Attackers who can label containers can use path traversal sequences to write files outside the extraction directory when users download and extract logs.
Text from CVE List
Affected versions 1
- dozzleaffected: 8.9.1 before 11.1.2CVE List
References 7
- github.com/amir20/dozzle/pull/5242Fixvia CVE List
- github.com/amir20/dozzle/commit/bc07db73dd84ce2cb939b744e983a8cfdf29c644Fixvia CVE List
- github.com/amir20/dozzle/releases/tag/v11.1.2Fixvia CVE List
- vulncheck.com/advisories/dozzle-before-11.1.2-path-traversal-via-log-zip-downloadAdvisoryvia CVE List
- github.com/amir20/dozzle/blob/v11.1.1/internal/web/download.go#L141-L146Referencevia CVE List
- github.com/amir20/dozzle/blob/v11.1.1/internal/container/docker/client.go#L610-L614Referencevia CVE List
- github.com/amir20/dozzleReferencevia CVE List