CVE-2026-105037

Summary

A file path traversal vulnerability in EnergizeLab station-middleware Docker images allows low-privilege users to read arbitrary server files, potentially exposing sensitive middleware code and secrets.

Exploitability

Easy to exploit with a registered account; attackers need only supply a crafted file path to access any file on the server filesystem.

Blast radius

Exploitation could expose critical middleware source code, configuration files, and server secrets across multiple affected deployments.

Detection

Monitor for unusual file access patterns in application logs, particularly requests accessing system paths like '/etc/passwd' or '/proc/self/environ' from authenticated user sessions.

Prioritized remediation

Upgrade to station-middleware Docker images version 1.8.3 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.