CVE-2026-128329: Dokploy 0.28.0 before 0.31.1 Path Traversal via patch.readRepoFile
Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to read arbitrary files by supplying ../ sequences in the filePath of patch.readRepoFile. Attackers with service read permission can read /etc/shadow, SSH private keys, and secret environment files on the Dokploy host or managed remote servers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.31.1
Event History
Frequently Asked Questions
Which deployments are affected?
Dokploy versions 0.28.0 through versions before 0.31.1 are affected. The vulnerable functionality can expose files on the Dokploy host and on managed remote servers.
What access does an attacker need?
An attacker must be an authenticated organization member with service read permission. They can exploit the issue by placing ../ sequences in the filePath supplied to patch.readRepoFile.
What information could be exposed?
The vulnerability can allow reading arbitrary files, including /etc/shadow, SSH private keys, and secret environment files. This may expose credentials and secrets stored on the Dokploy host or managed remote servers.