CVE-2025-53375
BaseFortify
Publication date: 2025-07-07
Last updated on: 2025-09-29
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dokploy | dokploy | to 0.23.7 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-53375 is a moderate severity vulnerability in Dokploy's Traefik integration that allows an authenticated attacker to read any file accessible by the Traefik process user. This includes sensitive files such as /etc/passwd, application source code, and environment variable files containing credentials and secrets. The vulnerability arises from insufficient path validation and authorization checks, which could allow directory traversal and unauthorized file access. It was fixed in Traefik version 0.23.7 by refining path validation to block directory traversal sequences and enforcing organization-based authorization checks. [1, 2]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive information such as system files, application source code, and environment variables containing credentials and secrets. Exploiting this flaw may result in full compromise of other services running in the environment or enable lateral movement by an attacker within the affected infrastructure, increasing the risk of broader security breaches. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately upgrade Traefik to version 0.23.7 or later, as this version contains the fix. Additionally, ensure that path validation is properly enforced to prevent directory traversal and unauthorized access, such as rejecting paths containing '../', '..\', or null bytes, and restricting paths to authorized directories only. Also, verify that authorization checks are in place to prevent unauthorized access to server configurations based on organization IDs. [1, 2]