6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27734

CVE-2026-27734: Beszel Vulnerable to Docker API Path Traversal via Unsanitized Container ID

Beszel is a server monitoring platform. Prior to version 0.18.2, the hub's authenticated API endpoints GET /api/beszel/containers/logs and GET /api/beszel/containers/info pass the user-supplied "container" query parameter to the agent without validation. The agent constructs Docker Engine API URLs using fmt.Sprintf with the raw value instead of url.PathEscape(). Since Go's http.Client does not sanitize ../ sequences from URL paths sent over unix sockets, an authenticated user (including readonly role) can traverse to arbitrary Docker API endpoints on agent hosts, exposing sensitive infrastructure details. Version 0.18.4 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27734

CVE-2026-27734:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/henrygd/beszel	go	<= 0.18.3	0.18.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal weakness in Beszel's authenticated API endpoints /api/beszel/containers/logs and /api/beszel/containers/info. The root cause is the lack of input validation and sanitization of the container query parameter. This user-supplied parameter, representing a Docker container ID, was passed directly from the hub to the agent. The agent, in turn, used this raw value to construct a URL path to communicate with the Docker Engine API via a Unix socket. Since Go's HTTP client does not sanitize ../ sequences in URL paths over Unix sockets, an authenticated attacker could craft a malicious container parameter (e.g., ../../version) to traverse the directory structure and access arbitrary Docker API endpoints on the agent host. This escalates privileges, as even a read-only user could exfiltrate sensitive infrastructure details. The patch addresses this by introducing strict validation of the container ID format on both the hub and agent sides, ensuring it's a valid hexadecimal string, and by using url.PathEscape to properly encode the container ID when constructing the Docker API URL, preventing path traversal.

Vulnerable functions

dockerManager.getContainerInfo

agent/docker.go

The function was vulnerable to path traversal because it constructed a Docker API endpoint URL by concatenating the raw `containerID` parameter using `fmt.Sprintf`. An attacker could provide a malicious `containerID` like `../../version` to traverse the filesystem and access arbitrary Docker API endpoints. The patch fixes this by using the `buildDockerContainerEndpoint` function which validates and escapes the `containerID`.

dockerManager.getLogs

agent/docker.go

Hub.containerRequestHandler

internal/hub/hub.go

This function handles API requests for container information and logs. It was vulnerable because it accepted the `container` query parameter from the user and passed it to backend functions without any validation. This allowed a malicious user to provide a path traversal payload in the `container` parameter. The patch adds a regular expression check to validate the format of the container ID.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.