This CVE presents a command injection vulnerability in dockwatch's compose.php, but the critical severity masks a more fundamental failure: the authentication bypass in loader.php isn't a bug—it's a category error. The code uses header('Location: ...') without exit() after the auth check, treating authentication as a user experience decision ('not logged in, go here') rather than a security boundary that must halt execution. That's a conceptual failure, not a typo.
The exploit is stateful: you must visit loader.php first to seed the session state, then pivot to compose.php with the malicious parameter. This isn't an exploit chain—it's two separate broken behaviors that happen to compose into RCE. That statefulness is why the EPSS of 0.04856 is low—not because the vulnerability is hard to exploit, but because it requires a specific deployment context and sequential attack. The question to press: how many other auth redirects in this codebase share the missing exit() pattern? If loader.php has this flaw, other authentication gates likely do too, creating latent bypasses waiting for the right stateful pivot.
The Docker socket context changes everything. Dockwatch is a Docker management tool, which means its deployment context includes Docker socket access. Command injection against a container with Docker socket access is container escape by definition—the socket doesn't need to be predictably mounted for exploitation to equal host compromise, it just needs to exist, which the tool's purpose guarantees. That framing removes 'but what if the socket isn't mounted' as a mitigating factor. The CVSS 9.8 is technically correct: command injection plus Docker socket equals host compromise.
For defenders: audit loader.php and every other auth gate for missing exit() after header() redirects. Search the codebase for the pattern header('Location without corresponding exit() or die(). Assume any session flag set through incomplete auth checks can be poisoned. Review the deployment model—if the Docker socket is mounted, treat any successful RCE as host compromise, not container-contained. The low EPSS reflects deployment scarcity and exploit complexity, not reduced severity. The real danger is in Docker-in-Docker and CI/CD contexts where the socket is routinely mounted.