Executive brief
Dokploy is a self-hosted application deployment platform that manages container orchestration and configuration. A path traversal vulnerability in its Traefik configuration settings allows remote attackers to write files to arbitrary locations on the server, potentially enabling code execution, data exfiltration, or complete system compromise without authentication required.
Technical details
The vulnerability exists in the writeTraefikConfigInPath function within packages/server/src/utils/traefik/application.ts (Settings component). The issue is a path traversal vulnerability where the path argument is insufficiently validated, allowing an attacker to manipulate the path parameter to write configuration files outside the intended directory. The attack is remotely exploitable and requires no authentication. An attacker can write arbitrary files to the server filesystem, potentially leading to remote code execution or configuration tampering. The exploit is publicly available and actively disclosed; the vendor has not provided a response or patch as of the advisory date.
Affected products
- Dokploy Dokploy up to 0.29.7
Timeline
- 2026-08-31: disclosed
- exploited: Exploit is now public