Medium
Dozzle before 11.1.2 Path Traversal via Log ZIP Download
Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive entry names in the log download endpoint. Attackers who can label containers can use path traversal sequences to write files outside the extraction directory when users download and extract logs.
Announced Group revision 1
Original source ↗CVE-2026-102332
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-102332
dozzle
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/amir20/dozzle",
"vendor": "amir20",
"product": "dozzle",
"versions": [
{
"status": "affected",
"version": "8.9.1",
"lessThan": "11.1.2",
"versionType": "semver"
}
],
"packageURL": "pkg:golang/github.com/amir20/dozzle",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-102332
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #5395 · Revision 1
- Added to Heist Feed
- Publisher date