CVE-2026-27734

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-27734

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27734.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-27734

Aliases

GHSA-phwh-4f42-gwf3

Published

2026-02-27T19:41:30.418Z

Modified

2026-03-03T01:23:47.442049Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Beszel Vulnerable to Docker API Path Traversal via Unsanitized Container ID

Details

Beszel is a server monitoring platform. Prior to version 0.18.2, the hub's authenticated API endpoints GET /api/beszel/containers/logs and GET /api/beszel/containers/info pass the user-supplied "container" query parameter to the agent without validation. The agent constructs Docker Engine API URLs using fmt.Sprintf with the raw value instead of url.PathEscape(). Since Go's http.Client does not sanitize ../ sequences from URL paths sent over unix sockets, an authenticated user (including readonly role) can traverse to arbitrary Docker API endpoints on agent hosts, exposing sensitive infrastructure details. Version 0.18.4 fixes the issue.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27734.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ]
}

References

Affected packages

Git / github.com/henrygd/beszel

Affected ranges

Type: GIT
Repo: https://github.com/henrygd/beszel
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

ac79860d4a8a3ce73c15797db339f9f230472033

Affected versions

v0.*

v0.0.1

v0.0.1-alpha.0

v0.0.1-alpha.1

v0.0.1-alpha.2

v0.0.1-alpha.3

v0.0.1-alpha.4

v0.0.1-alpha.5

v0.0.1-alpha.6

v0.0.1-alpha.7

v0.0.1-alpha.8

v0.0.1-alpha.9

v0.1.0

v0.1.1

v0.1.2

v0.10.0

v0.10.1

v0.10.2

v0.11.0

v0.11.1

v0.12.0

v0.12.0-beta1

v0.12.0-beta2

v0.12.1

v0.12.10

v0.12.11

v0.12.12

v0.12.2

v0.12.3

v0.12.4

v0.12.5

v0.12.6

v0.12.7

v0.12.8

v0.12.9

v0.13.0

v0.13.1

v0.13.2

v0.14.0

v0.14.1

v0.15.0

v0.15.1

v0.15.2

v0.15.3

v0.15.4

v0.16.0

v0.16.1

v0.17.0

v0.18.0

v0.18.1

v0.18.2

v0.18.3

v0.2.0

v0.3.0

v0.4.0

v0.5.0

v0.5.1

v0.5.2

v0.5.3

v0.6.0

v0.6.1

v0.6.2

v0.7.0

v0.7.1

v0.7.2

v0.7.3

v0.7.4

v0.8.0

v0.9.0

v0.9.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27734.json"