CVE-2026-45405 Dokku: Arbitrary File Write via Tar Symlink Traversal in git:from-archive and certs:add
Attackers can write arbitrary files via symlink traversal in archive extraction, potentially overwriting SSH keys to gain shell access on Dokku servers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-45405?
CVE-2026-45405 is a critical path traversal vulnerability in dokku, published on 26 Jun 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:from-archive and certs:add commands extract user-supplied tar/zip archives into temporary directories without sanitizing member paths or preventing symlink traversal. GNU tar creates symlinks during extraction and follows them for subsequent entries, allowing an attacker to write arbitrary files anywhere writable by the dokku user — including overwriting ~/.ssh/authorized_keys to gain unrestricted shell access. This vulnerability is fixed in 0.38.2.
Weakness: CWE-59
Which versions are affected by CVE-2026-45405?
It affects 1 product.
Products include Dokku Dokku.
How do I fix CVE-2026-45405?
No fix has been published for CVE-2026-45405 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-45405 being exploited?
There is no known exploitation of CVE-2026-45405 in the wild and no public exploit code.
Other vulnerabilities in dokku
- CVE-2026-45406 Dokku: Host RCE via Maliciously Named OpenResty Include Files Injected Through eval
- CVE-2026-45408 Dokku: OS Command Injection via App Name in Git Pre-Receive Hook
- CVE-2026-54636 Dokku: OS Command Injection via app.json managed Cron
- CVE-2026-45407 Dokku: Git Credentials in .netrc Stored World-Readable Due to Premature touch
Sources
Also known as GHSA-j6qq-xg73-ghqg.