---
id: CVE-2026-58455
title: Dockwatch 0.6.567 Unauthenticated OS Command Injection via ajax/compose.php
summary: >-
  Dockwatch through 0.6.567 contains an unauthenticated OS command injection
  vulnerability that allows remote attackers to execute arbitrary shell commands
  by exploiting a missing exit() after an authentication redirect in loader.php
  combi…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-698
  - CWE-78
vendor: Notifiarr
product: dockwatch
affected:
  - dockwatch <= 0.6.567
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-07-06T12:24:08.516828Z'
exploitAvailable: true
published: '2026-07-02'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:07:04.354Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-58455'
references:
  - url: 'https://github.com/Notifiarr/dockwatch/pull/135'
    label: Researcher PR
  - url: >-
      https://www.vulncheck.com/advisories/dockwatch-unauthenticated-os-command-injection-via-ajax-compose-php
tags:
  - cve.org
  - exploit-available
epss: 0.0804
epssPercentile: 0.94823
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/Boreas37/CVE-2026-58455-PoC'
  nuclei:
    - CVE-2026-58455
  checkedAt: '2026-11-08T14:51:57.333Z'
ingestedAt: '2026-11-08T14:51:22.292Z'
---

## Overview

Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands by exploiting a missing exit() after an authentication redirect in loader.php combined with unsanitized input passed to shell_exec() in ajax/compose.php. Attackers can seed the required session flag through the incomplete auth check, then inject arbitrary commands via the composePath POST parameter in the composePull action to achieve full host compromise, facilitated by the standard deployment mounting of the Docker socket.

## Affected

- `dockwatch <= 0.6.567`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.