Beszel is a server monitoring platform. Prior to version 0.18.2, the hub's authenticated API endpoints GET /api/beszel/containers/logs and GET /api/beszel/containers/info pass the user-supplied "container" query parameter to the agent without validation. The agent constructs Docker Engine API URLs using fmt.Sprintf with the raw value instead of url.PathEscape(). Since Go's http.Client does not sanitize `../` sequences from URL paths sent over unix sockets, an authenticated user (including readonly role) can traverse to arbitrary Docker API endpoints on agent hosts, exposing sensitive infrastructure details. Version 0.18.4 fixes the issue.
References
| Link | Resource |
|---|---|
| https://github.com/henrygd/beszel/releases/tag/v0.18.4 | Product Release Notes |
| https://github.com/henrygd/beszel/security/advisories/GHSA-phwh-4f42-gwf3 | Exploit Vendor Advisory |
Configurations
History
04 Mar 2026, 16:50
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:beszel:beszel:*:*:*:*:*:*:*:* | |
| First Time |
Beszel beszel
Beszel |
|
| References | () https://github.com/henrygd/beszel/releases/tag/v0.18.4 - Product, Release Notes | |
| References | () https://github.com/henrygd/beszel/security/advisories/GHSA-phwh-4f42-gwf3 - Exploit, Vendor Advisory |
27 Feb 2026, 20:21
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-27 20:21
Updated : 2026-03-04 16:50
NVD link : CVE-2026-27734
Mitre link : CVE-2026-27734
CVE.ORG link : CVE-2026-27734
JSON object : View
Products Affected
beszel
- beszel
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')