Dockwatch up to version 0.6.567 is vulnerable to an unauthenticated OS command injection that lets attackers run arbitrary shell commands. The flaw stems from a missing exit() after an authentication redirect in loader.php, which lets a malicious actor set a session flag, and unsanitized input passed to shell_exec() in ajax/compose.php, where the composePath POST parameter is used directly in command construction. The exploitation path is defined by CWE‑78 and CWE‑698, and it enables full host compromise when the Dockwatch container has unrestricted access to the Docker socket.

All releases of Notifiarr Dockwatch up to and including 0.6.567 are affected. Deployments that map the host Docker socket into the Dockwatch container without additional restrictions are especially vulnerable, as the container can then communicate with the host and potentially gain escalated privileges.

The vulnerability carries a CVSS score of 9.2, classifying it as Critical. An EPSS score of 5% indicates a low yet non‑zero likelihood that this flaw will be actively exploited. The flaw is not listed in CISA’s KEV catalog. Attackers need only reach the ajax/compose.php endpoint and can exploit the unauthenticated bug by sending a crafted POST request that sets the missing session flag and injects shell commands via the composePath parameter, leading to complete compromise of the host machine.