Vulnerabilities

EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from…

EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Node.js

Product

Node.js

CVSS

9.9

EPSS

0.004 (p34)

Exposure class

Developer platform

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-105037 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 23
   CVE NVD 16d ago

   EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs.

   CVSS 9.6 CVE-2026-105039 Node.js