Executive brief
Dokploy is a self-hostable platform used to manage and deploy applications. A security flaw allows users with basic deployment permissions to write files anywhere on the server's filesystem, bypassing intended security boundaries. This can lead to a total takeover of the server, data theft, and the installation of persistent backdoors.
Technical details
A path traversal vulnerability exists in the ZIP extraction logic within `/packages/server/src/utils/builders/drop.ts`. The application uses the `adm-zip` library to extract user-uploaded archives during deployment but fails to validate `entry.entryName` against traversal sequences (e.g., `../`). When combined with the remote server deployment feature, an attacker can use SFTP to write files outside the deployment directory. This allows for remote code execution by overwriting system files like cron jobs (`/etc/cron.d/`). The vulnerability is particularly severe because it bypasses container isolation on remote deployments. As of the advisory date, no patched version is explicitly listed, though remediation steps involving path normalization and prefix validation are recommended.
Affected products
- Dokploy Dokploy <= 0.26.5
Timeline
- 2026-05-11: advisory: Original GitHub security advisory published
- 2026-05-29: disclosed: CVE published to NVD dataset