Path Traversal in Dokploy Allows Arbitrary File Read

Executive Summary

CVE-2026-128329 is a path traversal vulnerability in Dokploy versions 0.28.0 to 0.31.0. It allows authenticated organization members with service read permissions to read arbitrary files on the host or managed remote servers by supplying ../ sequences in the filePath parameter of patch.readRepoFile. Attackers can access sensitive files like /etc/shadow, SSH private keys, or secret environment files.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Dokploy version is between 0.28.0 and 0.31.0. Run 'dokploy version' to verify. Inspect logs for unusual file read attempts in patch operations. Monitor for unauthorized access to sensitive files like /etc/shadow or SSH keys.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to severe confidentiality breaches. Attackers may read sensitive system files, steal credentials, or access confidential data like API keys and environment variables. If the application manages remote servers, attackers could access files on those servers as well, enabling lateral movement and further exploitation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized access to sensitive data. GDPR mandates strict protection of personal data, while HIPAA requires safeguarding protected health information. A breach could result in legal penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Dokploy to version 0.31.1 or later immediately. Restrict access to the patch.readRepoFile endpoint. Review and remove unnecessary permissions for organization members. Monitor for suspicious file access patterns.

Useful 0 Not Useful 0