CVE-2026-105037

EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets.

An attacker with a basic account can read sensitive configuration files and server secrets, potentially leading to further privilege escalation and compromise of the environment.

Upgrade the station-middleware Docker images to a version newer than 1.8.2 and verify whether server secrets have been exposed.