Adding a New Vulhub Environment

If the vulnerability is not a CVE, the directory name should be lowercase vulnerability name and the CVE-ID should be replaced with the directory name.

Naming Conventions

Step 1: Research the Vulnerability

Gather this information before writing any files:

• Official advisory or CVE description
• Affected software version ranges (both start and end)
• Root cause (e.g., deserialization, injection, path traversal)
• Exploit method and proof-of-concept
• Default credentials (if relevant)
• Network ports the service uses

Step 2: Create Base Dockerfile (if needed)

Check if base/<software>/<version>/ already exists. If it does, skip this step.

If creating a new base image:

FROM <official-upstream-image>:<version>

LABEL maintainer="phithon <[email protected]>"

RUN set -ex \
    && apt-get update \
    && apt-get install -y --no-install-recommends <packages> \
    && <install vulnerability dependencies> \
    && apt-get purge -y <build-only-packages> \
    && apt-get autoremove -y \
    && rm -rf /var/lib/apt/lists/*

Guidelines:

• Use official upstream images as the base when available
• Clean up package manager caches (rm -rf /var/lib/apt/lists/*)
• Prefer Debian-based images, do not choose -alpine variants when available
• Must pass hadolint linting (the CI runs this automatically)

Step 3: Write docker-compose.yml

Keep it minimal. Reference pre-built images from the vulhub/ Docker Hub namespace: