Dockwatch through version 0.6.567 is vulnerable to a missing exit() after an authentication redirect in loader.php that allows an attacker to set a session flag without authenticating. This flag bypass permits the attacker to send a POST request to ajax/compose.php with an unsanitized composePath value. The application then passes this value directly to shell_exec(), leading to an OS command–injection flaw defined by CWE‑78 and CWE‑698, which permits the execution of arbitrary shell commands on the host.

All releases of Notifiarr’s Dockwatch up to and including 0.6.567 are affected. Deployments that mount the Docker socket inside the Dockwatch container without additional restrictions are particularly vulnerable, because the container can communicate with the host Docker API and thus gain escalated privileges.

With a CVSS score of 9.2 the vulnerability is classified as critical, and an EPSS score of 1% indicates a low but non‑zero likelihood of exploitation. The flaw can be exploited by any remote actor that can reach the ajax/compose.php endpoint, requiring no authentication. It is not currently listed in CISA's KEV catalog, but the potential for full host compromise makes it highly consequential.