Dockge validates stack names only when saving a stack, but the path composed for stack retrieval or deletion lacks an allow‑list check. An authenticated user can supply a stack name containing traversal sequences, causing the server to resolve paths outside its intended directory. This allows reading .env or Compose files of any directory reachable by the Dockge process and deleting directories that contain a valid Compose file. Because Dockge often runs as root and has access to the Docker socket, the attacker gains confidentiality and integrity access to files of unrelated host applications. The exploitation requires API authentication; no remote code execution is involved, but the impact can be destructive.

The vulnerability affects deployments of the open‑source Dockge project distributed by louislam. The known affected release referenced in the advisory is v1.5.0; any other releases that have not removed the unvalidated stack name check are also affected. No other vendor or product is listed.

The CVSS score of 8.7 indicates high severity, with the main risk being loss of sensitive data and potential destruction of host files. EPSS data is not available, so the current likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting that public exploits are not yet confirmed. Attackers would need authenticated access to Dockge and the ability to specify stack names. Because deployments frequently run Dockge with root privileges, these conditions are often met, making exploitation plausible if the adversary can reach the Dockge API.