CVE-2026-82954

Received Received - Intake

Path Traversal in Dokploy Settings Component

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulDB

Description

A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the function writeTraefikConfigInPath of the file packages/server/src/utils/traefik/application.ts of the component Settings. The manipulation of the argument path results in path traversal. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-82954

EUVD

EUVD-2026-68895

Affected Vendors & Products

Vendor	Product	Version / Range
dokploy	dokploy	to 0.29.7 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in Dokploy versions up to 0.29.7. It exists in the writeTraefikConfigInPath function of the file packages/server/src/utils/traefik/application.ts. The vulnerability allows manipulation of the path argument, enabling unauthorized access to files outside intended directories. The attack can be executed remotely, and the exploit is already public.

Detection Guidance

This vulnerability involves path traversal in Dokploy up to version 0.29.7. Check if Dokploy is installed and verify the version. Look for unusual file access patterns or requests targeting the Traefik configuration path. Review server logs for suspicious path manipulation attempts in the settings component.

Impact Analysis

This vulnerability can allow attackers to read sensitive files, modify system configurations, or execute arbitrary code on the affected system. Since it affects a server component, it may lead to complete system compromise, data theft, or service disruption. The high CVSS scores indicate a severe risk of unauthorized access and data breaches.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other regulations due to unauthorized data access or exposure. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A breach could result in legal penalties, fines, and reputational damage.

Mitigation Strategies

Upgrade Dokploy to a version beyond 0.29.7 if available. If no patch exists, disable the affected component or restrict network access to the server. Monitor for exploitation attempts and apply network-level protections to block path traversal attempts.

Hi! I’m here to help you understand CVE-2026-82954. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70