External risk intelligence

EnergizeLab station-middleware Arbitrary File Read Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-105037

The vulnerability affects middleware in a Docker-based application. Since it functions as an internet-accessible service or API, it is commonly exposed as an edge-facing component in deployments, making it likely to be reachable from the internet.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability impacts EnergizeLab's station-middleware technology, allowing unauthorized access to sensitive server files through a known weakness. The exposure of middleware files and server secrets could pose a significant risk to system integrity.

Low-privilege users can read sensitive server files.
Critical systems can be compromised by reading server secrets.
Confirm relevance and exposure to your systems.

Attack Path

How an attacker could exploit the issue

An attacker with low-level access to the EnergizeLab station-middleware could exploit this vulnerability. By providing a specially crafted file path, an attacker can trick the middleware into reading sensitive files from the server. This could expose server secrets and middleware configuration, potentially leading to further compromise.

Low-privilege account required.
Attacker-controlled file path triggers vulnerability.
Exposes server secrets and middleware files.

Live Threat

Current exploitation, exposure, and threat context

A low-privilege account on EnergizeLab station-middleware could read arbitrary files from the server by supplying an attacker-controlled file path. This could expose sensitive middleware files and server secrets when supported by the advisory's conditions.

Middleware files and server secrets at risk.
Arbitrary file reads from server.
Compromised system integrity and secrets.

Operational Fix

Recommended remediation, mitigation, and detection steps

The EnergizeLab station-middleware, when deployed in Docker images, presents a critical risk where low-privilege users can access sensitive files. This vulnerability necessitates immediate attention from the application owners and the platform or infrastructure teams responsible for the middleware's deployment and security. The first practical step involves identifying all instances of the affected middleware, assessing their exposure and business criticality, and confirming the accountable owner for remediation planning.

Application and platform teams own remediation.
Verify affected middleware instances and exposure.
Plan risk-based remediation and vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is EnergizeLab station-middleware?

EnergizeLab station-middleware is a server-side component built on the NestJS framework, commonly packaged in Docker containers. It acts as an intermediary layer in automation or robotics ecosystems, managing communications and data flow between client devices and core systems. Developers use it to handle API requests and service logic within these environments.

What does CVE-2026-105037 mean in plain English?

This vulnerability is classified as Improper Neutralization of Input During Pathname Resolution (CWE-73). It means the software does not properly filter file paths provided by a user. Because of this, an attacker can input a path of their choosing to trick the system into opening files it should keep private, such as server configuration files or authentication secrets.

How is this vulnerability triggered?

An attacker triggers this flaw by supplying a malicious file path to the middleware while logged into a registered, low-privilege account. Importantly, this is not a public, unauthenticated attack; it requires an existing valid account. Requests that do not include these specific, attacker-controlled file paths will not trigger the file read mechanism.

Is my instance affected by this?

Halo Surface Signal indicates this middleware is frequently deployed as an internet-accessible service or API. If your instances are edge-facing and reachable from the internet, they are at higher risk. You should determine if your deployment is exposed to the public network or if it sits within a restricted internal environment.

What steps should I take if I run this technology?

Begin by auditing your environment to locate all running instances of the affected EnergizeLab station-middleware. Once identified, evaluate whether these services are internet-facing or isolated. Coordinate with your application and infrastructure teams to prioritize these instances for remediation planning and check for vendor-supplied updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.