CVE-2026-128328: Dokploy 0.28.0 before 0.31.1 Path Traversal via patch.readRepoDirectories repoPath
Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to list tracked files of any git repository by supplying an arbitrary repoPath to patch.readRepoDirectories. Attackers with read access to one service can enumerate file and directory names of other tenants' application and compose source trees on the host or managed servers.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokployto a version that resolves this vulnerability.Fixed in 0.31.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Dokploy organization member can exploit it. The member needs read access to at least one service, but can use the affected endpoint to enumerate tracked file and directory names from other tenants' application and compose source trees.
What information can an attacker obtain?
The issue allows listing tracked files and directory names in Git repositories. It affects application and compose source trees on the host or managed servers; the provided information does not indicate that file contents can be read.
Which releases are affected?
Dokploy 0.28.0 through versions before 0.31.1 are affected. Version 0.31.1 is not included in the affected range.
How is the traversal performed?
The attacker supplies an arbitrary repoPath to the patch.readRepoDirectories functionality. This lets the request target repositories beyond the service to which the attacker has read access.