CVE-2026-102332

MEDIUM 6.1

Dozzle before 11.1.2 Path Traversal via Log ZIP Download

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive entry names in the log download endpoint. Attackers who can label containers can use path traversal sequences to write files outside the extraction directory when users download and extract logs.

CWE	CWE-22
Vendor	amir20
Product	dozzle
Published	Sep 28, 2026

Stay Ahead of the Next One

Get instant alerts for amir20 dozzle

Be the first to know when new medium vulnerabilities affecting amir20 dozzle are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

amir20 / dozzle

8.9.1 < 11.1.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/amir20/dozzle/pull/5242 github.com: https://github.com/amir20/dozzle/commit/bc07db73dd84ce2cb939b744e983a8cfdf29c644 github.com: https://github.com/amir20/dozzle/releases/tag/v11.1.2 github.com: https://github.com/amir20/dozzle/blob/v11.1.1/internal/web/download.go#L141-L146 github.com: https://github.com/amir20/dozzle/blob/v11.1.1/internal/container/docker/client.go#L610-L614 github.com: https://github.com/amir20/dozzle vulncheck.com: https://www.vulncheck.com/advisories/dozzle-before-11.1.2-path-traversal-via-log-zip-download

Credits

Lazizbek Djurayev (Haad TC)