EQSTLab/CVE-2025-55182

GitHubRepository PoC

PoC files

21 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

cve-2025-55182/docker-compose.yml

Created Vuln labCVE-2025-55182Compose · builds

1 Compose manifest · 1 Dockerfile · 1 service

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that builds and runs a Next.js 16.0.6 application in production mode, exposing port 3000. The project name and container name reference CVE-2025-55182, and the Next.js version is flagged as having a security vulnerability (CVE-2025-66478).

cve-2025-55182/docker-compose.yml:1-11cve-2025-55182/Dockerfile:1-23cve-2025-55182/package.json:1-26

Lab assessment

Vulnerability lab

The repository is named after CVE-2025-55182, the container is named EQSTLab-CVE-2025-55182, and the pinned Next.js version (16.0.6) is explicitly deprecated in its package-lock.json entry due to a security vulnerability (CVE-2025-66478). These identifiers, combined with the minimal boilerplate application, indicate a purpose-built environment for vulnerability research or reproduction.

cve-2025-55182/docker-compose.yml:5cve-2025-55182/package-lock.json:1-6550cve-2025-55182/package.json:11
Lab shapeCompose · builds
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

nextjs

vulnerable targetNext.js web application

A Next.js 16.0.6 application built from a multi-stage Dockerfile and run in production mode. It serves a default create-next-app page on port 3000. The version is flagged as vulnerable.

cve-2025-55182/docker-compose.yml:4-10cve-2025-55182/Dockerfile:1-23cve-2025-55182/package.json:11
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-55182

Insufficient evidence

The CVE ID appears in the repository name, container name, and project name, but no exploit code, vulnerability description, or reproduction steps are present in the supplied evidence. The association is nominal only.

cve-2025-55182/docker-compose.yml:5cve-2025-55182/package.json:2
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the environment.cve-2025-55182/docker-compose.yml:1-11
  • The Next.js application must be built and started; the Dockerfile and Compose file automate this.cve-2025-55182/Dockerfile:1-23

Evidence-described exercise path

  1. Build and start the container using 'docker compose up'.cve-2025-55182/docker-compose.yml:1-11
  2. Access the Next.js application on http://localhost:3000.cve-2025-55182/docker-compose.yml:7
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a standard Next.js production container with no visible commands that escape the container, access the host, or connect externally beyond the expected web port. No hidden payloads, credential theft, or destructive behavior is present in the supplied text files.

cve-2025-55182/docker-compose.yml:1-11cve-2025-55182/Dockerfile:1-23
Review boundaries

What the analysis did not establish

  • No exploit code, proof-of-concept, or vulnerability description is included; the CVE association is based solely on naming and a deprecated package warning.
  • One binary file (favicon.ico) is uninspected.
  • The README is a default create-next-app template and provides no lab-specific instructions.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: 1 binary file not inspected

Linked vulnerabilities

1