Path Traversal in Dokploy Allows Git Repository Enumeration

Executive Summary

Dokploy versions 0.28.0 to 0.31.0 have a path traversal flaw in the patch.readRepoDirectories function. Authenticated organization members can list files from any Git repository by providing an arbitrary repoPath parameter. This allows attackers with read access to one service to enumerate file and directory names of other tenants' applications or managed servers, potentially exposing sensitive information or enabling further attacks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Dokploy instance is running a vulnerable version (0.28.0 to 0.31.0). Review logs for unauthorized attempts to access patch.readRepoDirectories with arbitrary repoPath parameters. Monitor for unusual directory enumeration requests in application logs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could use this flaw to gather information about other tenants' applications, such as directory structures and file names. While file contents are not directly exposed, this reconnaissance could help attackers plan further exploits, like reading sensitive data or conducting privilege escalation attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, unauthorized disclosure of personal or health information, and non-compliance with regulatory obligations for data protection and access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Dokploy to version 0.31.1 or later immediately. Review and restrict access to organization members with read permissions. Monitor for suspicious activity in patch operations and enforce strict input validation for repoPath parameters.

Useful 0 Not Useful 0