cve-images — intentionally vulnerable lab images

A collection of deliberately vulnerable Docker images for security study in an isolated lab. Started as nginx CVE reproductions and is growing into a broader set of vulnerable-by-design images (e.g. DVWA).

⚠️ Safety

These images are vulnerable on purpose. One of the nginx CVEs (CVE-2026-42945) is being exploited in the wild. Run them only on an isolated/local network. Never deploy to a public host, and never publish them as if they were production images. Each image carries lab.vulnerable=true and a description saying so.

nginx CVE images

All built on a shared base that compiles nginx 1.30.0 from source — the last release affected by these CVEs (fixed in 1.30.1 / 1.31.0).

Application images

Each folder has its own README.md with details and references.

Build locally

The nginx base must be built first (the CVE images FROM it):

docker build -t rwils83/nginx-vuln-base:1.30.0 ./base
docker build -t rwils83/cve-2026-42945:1.30.0 ./cve-2026-42945-rewrite-lab
docker build -t rwils83/cve-2026-42946:1.30.0 ./cve-2026-42946-scgi-uwsgi-lab
docker build -t rwils83/cve-2026-40701:1.30.0 ./cve-2026-40701-resolver-lab
docker build -t rwils83/cve-2026-42934:1.30.0 ./cve-2026-42934-charset-lab
docker build -t rwils83/dvwa_with_curl:latest ./dvwa-curl-lab

./build_all.sh builds the nginx set (base + 4 CVE images).

Releases (GitHub Actions → Docker Hub)

CI builds every *-lab/ image on each PR/push (build-only, no push) to catch breakage before merge. Publishing is driven by git tags:

git tag v1.30.0-lab.2 && git push --tags    # release the nginx images
git tag dvwa-v1        && git push --tags    # release DVWA

Publishing requires the repo secrets DOCKERHUB_USERNAME and DOCKERHUB_TOKEN.