Dockhand before version 1.0.46 has a flaw that permits a non‑admin user with the "stacks:edit" role to read any file on the host that the container can access. By sending an absolute path to the /api/system/files/content endpoint, an attacker can retrieve sensitive files such as /etc/shadow, /etc/passwd, git configuration files, and private SSH keys that are stored inside the Dockhand container. The vulnerability is classified as CWE‑863, reflecting unauthorized data access through an API parameter.

Vulnerability affects the Finsys Dockhand application. All versions earlier than 1.0.46 are impacted because the issue was fixed in release v1.0.46. The flaw is not limited to a particular operating system, but any deployment of Dockhand that exposes the /api/system/files/content route to authenticated users with edit permission is at risk.

The CVSS score of 7.1 indicates medium‑to‑high severity. Exploitation requires the attacker to be authenticated, but only with a role that grants stack editing, a privilege commonly available to service users. The EPSS score is not reported, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known public exploitation yet. Nevertheless, because the data exposed can include password hashes and SSH keys, the potential impact on confidentiality is significant and warrants prompt action. The attack vector is through the documented HTTP API, so network reachability to the server is a prerequisite.