Dozzle versions older than 11.1.2 build ZIP archive entry names from container display names without sanitization. Attackers who can assign labels to containers can embed path traversal sequences in those names, enabling the log download endpoint to produce ZIP entries that resolve outside the extraction directory when a user downloads and extracts the logs. The resulting arbitrary file write can overwrite critical files or deposit malicious artifacts, compromising the integrity and confidentiality of the host. The vulnerability is classified as CWE-22 and carries a CVSS score of 4.6, indicating a moderate severity.

The affected product is Dozzle, developed by amir20. All releases prior to version 11.1.2 are vulnerable; dozens of installations may be at risk if they continue to run those older releases. The issue manifests when the application permits container renaming or labeling, a capability typically available to privileged users or developers deploying containers via Dozzle.

The CVSS score of 4.6 reflects a moderate risk level with limited impact. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to be able to label or rename containers in Dozzle, which usually demands privileged or at least authenticated access to the application or underlying Docker API. Once that condition is met, the attacker can trigger a log download, extract the ZIP locally, and place files outside the intended directory, leading to potential data exfiltration or system compromise. The lack of public exploits suggests moderate threat, but the impact for privileged attackers could be significant.