Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
1.3
CVE-2026-105137: Laradock Dockerfile may download code without verification
CVE-2026-105137 · published 15 days ago
Summary
Versions of Laradock up to 20.4 contain a Dockerfile step that fetches code without checking its integrity, which could let a remote attacker supply malicious files. While exploiting this requires significant effort, the method is publicly known, so organizations should upgrade to a newer Laradock release or modify the Dockerfile to add proper integrity checks before downloading code.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| – | laradock | 20.0 |
Original advisory text
Laradock Build Process Dockerfile code download
A vulnerability was found in Laradock up to 20.4. Impacted is an unknown function of the file workspace/Dockerfile of the component Build Process. The manipulation results in download of code without integrity check. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-494Download of Code Without Integrity Check
Timeline
Published4 Oct 2026
Updated15 Oct 2026
First seen4 Oct 2026
Track software like this
Free during beta