CVE-2026-102332

Executive Summary

CVE-2026-102332 is a path traversal vulnerability (CWE-22) in Dozzle, a real-time log viewer for Docker containers, affecting all versions before 11.1.2. The application fails to sanitize container display names when constructing ZIP archive entry names for the log download feature, allowing an attacker who can label containers to embed directory traversal sequences that escape the intended extraction directory. When a user downloads and extracts the resulting log archive, the malicious entry can overwrite arbitrary files on the victim's system, creating a write-outside-root condition.

Technical Analysis

Dozzle aggregates and streams container logs from a Docker daemon and exposes them through a web interface. Its log download endpoint generates a ZIP archive whose per-file entry names are derived, at least in part, from the container display name—the human-readable label assigned to a container. The vulnerability arises because the code path that builds ZIP entry names for the archive does not sanitize or normalize that display name.

In a well-formed archive, each entry name is a relative path that must remain inside the archive root when extracted. If the display name contains traversal sequences such as ../, backslash separators, absolute prefixes, or other platform-specific path constructs, the entry name composed at archive-build time inherits those sequences. Many ZIP extractors normalize entry names by stripping leading slashes and resolving .. segments only partially or not at all, and some (particularly GUI and library extractors) will faithfully write to the resolved path. The result is a "ZIP slip" / archive path traversal: a file inside the archive is written to a location outside the directory the user selected for extraction.

Two conditions gate exploitation. First, the attacker must be able to set or influence a container display name—typically by controlling a container label, a docker run --name value, or a Compose service name on a host the victim monitors. This raises the effective attack complexity and is reflected in the AC:H rating. Second, the victim must download the archive and extract it, an interaction requirement captured by UI:R. Because the write lands outside the extraction directory (a scope change relative to the vulnerable component's intended boundary), the vector includes S:C. Integrity impact is high (arbitrary file overwrite, within the extracting user's privileges) while confidentiality and availability impacts are rated none.

The root cause is a failure to treat untrusted container metadata as hostile input at the point where it is serialized into a filesystem path structure. Container names and labels are frequently treated as cosmetic metadata rather than attacker-controlled data, which is why this class of flaw recurs in tooling that exports aggregated container state into archives.

No public proof-of-concept, exploit code, or Nuclei template is known at the time of writing, and the CVE is not listed in CISA KEV. The patch-confidence assessment is 0/4: no vendor advisory, commit, release note, or package-advisory evidence has been captured in the tracked sources for this record, so the vulnerability should be treated as unpatched for operational purposes.

Exploitation Scenarios

1. Reconnaissance / target identification. The attacker identifies a Dozzle instance, typically a web-accessible log viewer fronting one or more Docker hosts. Shodan-style fingerprinting for the Dozzle product and web UI title yields candidate targets. The attacker's goal is a target where they can place or rename a container whose logs will be exported by a victim.
2. Triggering the flaw class. The attacker obtains the ability to influence a container display name on a monitored host—for example by deploying a container with a chosen name, or by setting a label that Dozzle renders as the display name. The display name is crafted to contain path traversal sequences such as relative-parent segments (the classic ../ form) or equivalent constructs for the target platform, so that the name is not a safe relative path when used as a ZIP entry name.
3. Payload / execution method at the vulnerability-class level. The attacker waits for (or induces) an operator to download the log archive for the affected container through the Dozzle log download function, then extract it. During extraction, the archive entry whose name carries the traversal sequence resolves to a path outside the chosen extraction directory, and the contained file is written there. The specific file content and the target path are attacker-chosen to the extent that the display-name field and the archived log content can be influenced.
4. Post-exploitation impact. Successful exploitation yields an arbitrary-file-write primitive constrained by the extraction user's permissions and filesystem layout. Depending on what path is targeted, consequences range from overwriting user configuration or cron entries to planting files consumed by other local software. Because confidentiality and availability are rated none in the CVSS vector, the primary realized impact is integrity compromise of files local to the victim that extracts the archive.

No public PoC is available; the attack chain above is inferred from the vulnerability class (CWE-22) and the behavior described in the NVD entry, and does not rely on any specific function, endpoint, or parameter names beyond those stated in the description (the container display name and the log download endpoint).

Impact Assessment

The blast radius is defined less by the vulnerable service than by the ecosystem of people who extract its archives. The Dozzle instance itself is rated C:N/I:H/A:N, indicating that the service's own confidentiality and availability are unaffected; the destructive effect is displaced onto the extracting client. The integrity impact is high because a successful path traversal write can replace arbitrary files writable by the extracting user. Scope is changed (S:C) because the vulnerability in the archive-generation component produces effects in the extracting system, a different security authority. Exploitability is moderated by AC:H and UI:R—the attacker must control container naming and must convince or wait for a human to extract the archive—yielding a base score of 6.1 (Medium). Affected systems include any deployment running Dozzle versions before 11.1.2 that both (a) permits untrusted parties to create or rename containers and (b) distributes downloaded log archives to operators, support engineers, or automated pipelines that extract them without path sanitization. In shared CI or support workflows where archives are fetched from many customer environments and unpacked by a single analyst workstation, the practical blast radius is the analyst's workstation, which may hold credentials and configuration far more sensitive than the logs themselves.

Detection Guidance

Sigma Rule

title: Dozzle ZIP Log Download With Path Traversal in Container Name
id: 6f3d5b1e-9c47-4a2e-8d10-2b7f4e6a1c33
status: experimental
description: Detects download of Dozzle log archives where response or request context references container display names containing traversal sequences (CVE-2026-102332).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102332
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/api/'
  selection_zip:
    cs-uri-query|contains:
      - 'download'
      - 'zip'
      - 'logs'
  selection_traversal:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '..%5c'
      - '%2e%2e%2f'
  condition: selection_endpoint and selection_zip and selection_traversal
falsepositives:
  - Legitimate container names containing dots or unusual characters
level: medium
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.102332

YARA Rule

rule CVE_2026_102332_Dozzle_Zip_Traversal
{
    meta:
        description = "Detects ZIP archives containing entry names with traversal sequences likely generated by vulnerable Dozzle log export"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102332"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $pk = { 50 4B 03 04 }
        $trav1 = "../" ascii
        $trav2 = "..\\" ascii
        $trav3 = "..%2f" ascii
        $dozzle = "dozzle" nocase ascii

    condition:
        $pk at 0 and any of ($trav*) and filesize < 50MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102332 Dozzle log download with path traversal in container name"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"download"; nocase; http.uri; content:"..%2f"; nocase; sid:2026102332; rev:1; reference:cve,2026-102332; classtype:attempted-recon; metadata:affected_product Dozzle, created_at 2026_01_01, cve CVE_2026_102332;)

Elastic Detection

sequence by host.id, user.name with maxspan=30s
  [ file where event.action == "creation" and file.name : "*.zip" and
      file.Ext.header_bytes : "504b0304*" ]
  [ file where event.action == "creation" and
      file.path : ("*/../*", "*..\\*") and
      not file.path : ("/tmp/*", "/var/tmp/*") ]

Splunk SPL Query

index=web OR index=proxy
| eval raw=lower(_raw)
| where (match(raw, "download") OR match(raw, "zip") OR match(raw, "logs"))
        AND (match(raw, "\.\.%2f") OR match(raw, "\.\./") OR match(raw, "%2e%2e%2f") OR match(raw, "\.\.%5c"))
        AND (match(raw, "dozzle") OR match(raw, "container"))
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, host, uri_path
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,dozzle,cve-2026-102332,">
  <rule id="202610232" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>download|zip|logs</url>
    <regex type="pcre2">(?i)(\.\.%2f|\.\./|%2e%2e%2f|\.\.%5c)</regex>
    <description>CVE-2026-102332: Dozzle log download request contains path traversal sequence in container display name</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_102332,</group>
  </rule>

  <rule id="202610233" level="12">
    <if_sid>202610232</if_sid>
    <description>CVE-2026-102332: Possible Dozzle ZIP archive path traversal exploitation attempt</description>
    <group>cve_2026_102332,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4: no vendor fix, release artifact, commit, or package-advisory evidence has been captured in the tracked sources for this record. Treat CVE-2026-102332 as unpatched for planning purposes and drive remediation through the controls below. The NVD description states that Dozzle versions before 11.1.2 are affected; confirm any 11.1.2-or-later artifact against the vendor's own release channel before relying on it, and re-evaluate patch confidence as evidence becomes available.

1. Immediate mitigations.

   • Restrict who can create, rename, or label containers on any Docker host monitored by Dozzle. Container naming is the input primitive for this flaw; removing untrusted naming privilege removes the attack path.
   • Treat every downloaded log archive as untrusted input. Extract archives only in a sandboxed directory, and never as a privileged user; use extraction tools that sanitize entry names or explicitly refuse entries containing parent-directory segments.
   • Reduce Dozzle exposure: place the interface behind authentication and network segmentation, and avoid publishing it to the public internet.
   • Where feasible, disable or workflow-restrict the log download/archive export function until a fixed build is validated.

2. Patch/upgrade steps.

   • Monitor the Dozzle project's release channel for a version at or above 11.1.2 and review the associated changelog to confirm the archive entry-name sanitization fix. Do not assume availability based on the NVD version statement alone.
   • When upgrading, deploy to a canary instance first, generate a test archive containing a container name with traversal-looking characters, and verify that the resulting ZIP entry names are normalized and cannot escape the extraction directory.
   • Track the CVE record for the publication of vendor advisories or package-advisory data that would raise patch confidence above 0/4.

3. Long-term hardening.

   • Adopt a path-handling standard across internal tooling: any value derived from external metadata that becomes a filesystem component must be canonicalized and validated against an allowed base directory, rejecting absolute paths, parent-directory segments, and alternate separators.
   • Integrate archive-slip checks into CI: scan generated ZIPs and tarballs for entry names that resolve outside the archive root.
   • Enforce least privilege for container orchestration: separate the identities permitted to define container metadata from those that view logs.
   • Include CWE-22 and archive-extraction classes in secure-code review checklists for any component that serializes untrusted metadata into file paths.

References

• NVD — CVE-2026-102332: https://nvd.nist.gov/vuln/detail/CVE-2026-102332
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• FIRST EPSS (score not yet published for this CVE at time of writing): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-102332 not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Dozzle project repository and release history (verify version 11.1.2 changelog directly): https://github.com/amir20/dozzle

No public proof-of-concept, exploit code, or Nuclei template is known for CVE-2026-102332, and there is no evidence of exploit-in-the-wild activity or associated threat-actor campaigns in the provided data.