CVE-2026-105137
Published:October 04, 2026
Updated:November 13, 2026
A vulnerability was found in Laradock up to 20.4. Impacted is an unknown function of the file workspace/Dockerfile of the component Build Process. The manipulation results in download of code without integrity check. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The exploit has been made public and could be used. Upgrading to version 20.5 is recommended to address this issue. The patch is identified as c3494f432668472056aa0a9134ff4e0d9d2e8cea. You should upgrade the affected component. The vendor confirms: "The fix replaces the reported plaintext Event and New Relic downloads with HTTPS-only downloads and checks pinned SHA-256 hashes before extracting the archives. We also fixed the Event download in the PHP-FPM Dockerfile, in addition to the locations you identified."
Affected Packages
https://github.com/laradock/laradock.git (GITHUB):
Affected version(s) =v13.0 <v20.5 || =v14.0 <v20.5 || =v15.0 <v20.5 || =v16.0 <v20.5 || =v17.0 <v20.5 || >=v18.0 <v20.5 || =v19.0 <v20.5 || >=v20.0 <v20.5Fix Suggestion:
Update to version v20.5Related Resources (11)
Do you need more information?
Contact UsCVSS v4
Base Score:
1.3
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
PASSIVE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
LOW
Vulnerable System Availability
LOW
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
Exploit Maturity
POC
CVSS v3
Base Score:
5
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
LOW
Exploit Maturity
PROOF-OF-CONCEPT
Weakness Type (CWE)
Download of Code Without Integrity Check
EPSS
Base Score:
0.16