CVE-2026-73040 is a path traversal in Dockge's Stack class where input validation was implemented on the write path but not enforced on read or delete operations. The critical failure is not that developers failed to consider path traversal—they explicitly created a validation function validate() with the allow-list regex ^[a-z0-9_-]+$ for stack names in the save() method. This guard exists, is discoverable, but is not architecturally enforced. Nothing in the Stack class structure compels getStack() or delete() to route through this validation before constructing filesystem paths from user input.
An attacker controlling the stack name parameter can traverse to read arbitrary files using composeENV or composeYAML, or delete arbitrary directories using the delete() path. The compose file requirement for deletion is trivial to satisfy—an attacker who has navigated to any directory already knows or can trivially create a valid compose.yaml there. Once that gate passes, fsAsync.rm runs with recursive and force flags regardless of what else exists at the target.
This vulnerability's severity is substantially amplified by Dockge's Docker socket access. The blast radius extends beyond local filesystem disclosure to potential lateral movement through the Docker API—container termination, network configuration access, and interaction with unrelated services running in other containers. This is not a contained file-read vulnerability; it's a filesystem primitive that can reach the entire container ecosystem.
The disableAuth configuration option transforms this from an authenticated vulnerability to an unauthenticated one by eliminating the authentication check entirely. This is not a convenience feature—it is an architectural decision that places the entire security boundary on network isolation alone. If disableAuth is in use, any network-adjacent attacker gains the traversal capability without credentials.
To defend this CVE: immediately audit all Stack class method calls in your socket handlers and verify they route through the validation function. Add the same ^[a-z0-9_-]+$ constraint to getStack() and delete() paths. Restrict Docker socket access to the minimum required scope—consider whether Dockge needs socket access at all, or whether read-only API access suffices for its function. Review any deployment with disableAuth enabled and treat it as internet-facing insecurely unless network segmentation is explicitly documented and enforced.