# CVE-2026-123373: compose-lint path traversal via symlink following in Compose files

Source: https://junglewise.ai/threats/cve-2026-123373-compose-lint-is-a-docker-compose-security-linter-that-identifies  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-123373 · Severity: medium · CVSS 4 · Published 2026-11-09

compose-lint is a Docker Compose security linter that checks configurations before deployment. Versions 0.2.0 through 0.24.x follow symbolic links in Compose file references without verifying they stay within the project directory, allowing attackers to read arbitrary files on the host system and expose credentials or file contents in scan reports.

Technologies: [tmatens/compose-lint (GitHub Actions)](https://junglewise.ai/threats/technologies/actions-tmatens-compose-lint), [compose-lint (PyPI)](https://junglewise.ai/threats/technologies/pypi-compose-lint). Vendors: [GitHub Actions](https://junglewise.ai/threats/vendors/actions), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-123373 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123373 being exploited in the wild.

**How severe is CVE-2026-123373?** Medium severity, with a CVSS score of 4, published 9 November 2026.

**Which products and versions are affected?** tmatens/compose-lint (GitHub Actions) >= 0.2.0, <= 0.24.0, ECOSYSTEM:introduced=0.2.0,fixed=0.25.0|GIT:introduced=60c091c7cc8f86c6b0c5954031097364fea0a201,fixed=cb12b5313ff1fb182ff3c832b41ff3d574a68c6b; compose-lint (PyPI) >= 0.2.0, <= 0.24.0, ECOSYSTEM:introduced=0.2.0,fixed=0.25.0; Todd Matens Compose-Lint 0.2.0 to 0.24.x.

**Is there a fix for CVE-2026-123373?** Yes. tmatens/compose-lint (GitHub Actions): upgrade to 0.25.0 or later; compose-lint (PyPI): upgrade to 0.25.0 or later. Until then: Restrict commit access to the repository or manually review pull requests that add or modify symbolic links in Compose file references, COMPOSE_FILE entries, and env_file targets before merge. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123373 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-123373?** Check whether you run tmatens/compose-lint (GitHub Actions), compose-lint (PyPI) or Todd Matens Compose-Lint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tmatens/compose-lint (GitHub Actions): upgrade to 0.25.0 or later
- compose-lint (PyPI): upgrade to 0.25.0 or later

  ```sh
  pip install "compose-lint>=0.25.0"
  ```


Restrict commit access to the repository or manually review pull requests that add or modify symbolic links in Compose file references, COMPOSE_FILE entries, and env_file targets before merge.

## Technical details

The vulnerability is a path traversal flaw in how compose-lint validates env_file targets and COMPOSE_FILE entries. The tool performs only lexical (document-level) checks to ensure paths appear project-relative, but does not verify the actual filesystem resolution; a committed symlink passes the lexical test while pointing anywhere on the runner. This allows an attacker to commit a symlink to an out-of-project file (e.g., /home/runner/.aws/credentials), causing compose-lint to read it and expose key names via CL-0020/CL-0021 findings or arbitrary file content in SARIF/JSON output. Additionally, YAML parse errors quote source lines verbatim, republishing credentials if a syntax error occurs on a line containing them.

## Affected products

- Todd Matens compose-lint 0.2.0 to 0.24.x

## Identifiers

- CVE-2026-123373
- GHSA-whr6-fgpq-fpv9

## Timeline

- 2026-11-09: disclosed
- 2026-08-24: patched

## References

- [https://github.com/tmatens/compose-lint/commit/364814329417dbbc34d1ad2f3981f8a7a023799e](https://github.com/tmatens/compose-lint/commit/364814329417dbbc34d1ad2f3981f8a7a023799e)
- [https://github.com/tmatens/compose-lint/pull/721](https://github.com/tmatens/compose-lint/pull/721)

## Related threats

- [compose-lint GitHub Action workflow command injection via symlink path](https://junglewise.ai/threats/cve-2026-125125-compose-lint-is-a-docker-compose-security-linter-that-identifies)
- [compose-lint command injection via unsanitized stderr output](https://junglewise.ai/threats/cve-2026-125123-compose-lint-is-a-docker-compose-security-linter-that-identifies)
- [compose-lint CI command injection in JSON and SARIF output](https://junglewise.ai/threats/cve-2026-125122-compose-lint-is-a-docker-compose-security-linter-that-identifies)
- [compose-lint workflow command injection via Unicode whitespace](https://junglewise.ai/threats/cve-2026-125121-compose-lint-is-a-docker-compose-security-linter-that-identifies)
- [compose-lint information disclosure via incomplete .env remediation at finding limit](https://junglewise.ai/threats/cve-2026-123796-compose-lint-is-a-docker-compose-security-linter-that-identifies)