Executive brief
Dokku is an open-source Platform-as-a-Service (PaaS) that helps developers deploy and manage applications. A security flaw in how it handles uploaded files allows an attacker to trick the system into writing files to unauthorized locations. This could allow an attacker to gain full administrative control over the server, potentially leading to data theft or service disruption.
Technical details
A symlink traversal vulnerability exists in Dokku's archive extraction logic within the 'git:from-archive' and 'certs:add' commands. The root cause is a failure to sanitize member paths or prevent GNU tar from following symlinks created during the extraction process. An attacker with low privileges can provide a specially crafted tar or zip archive containing symlinks that point outside the intended extraction directory. By following these links, the extraction process can overwrite arbitrary files with the permissions of the 'dokku' user, such as SSH authorized_keys, leading to remote code execution and full shell access. This issue is resolved in version 0.38.2 by implementing archive pre-scanning and utilizing the --no-unsafe-links flag.
Affected products
- Dokku Dokku < 0.38.2
Timeline
- 2026-05-09: patched: Fix merged into master branch
- 2026-05-10: advisory: Release 0.38.2 published
- 2026-06-26: disclosed: CVE published to NVD