Description
Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to list tracked files of any git repository by supplying an arbitrary repoPath to patch.readRepoDirectories. Attackers with read access to one service can enumerate file and directory names of other tenants' application and compose source trees on the host or managed servers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Dokploy | dokploy | 0.28.0 – < 0.31.1 | 0.31.1 |
References
- GitHub Security Advisory (GHSA-q7cq-vxv7-449c) vendor-advisory
- https://github.com/Dokploy/dokploy/commit/4b582856b36a0d037ff43ecbed2026d93f22ecc6 patch
- https://github.com/Dokploy/dokploy/pull/5899 issue-tracking patch
- dokploy v0.31.1 Release Notes release-notes
- https://github.com/Dokploy/dokploy/blob/v0.31.0/apps/dokploy/server/api/routers/patch.ts#L181-L202 technical-description
- https://github.com/Dokploy/dokploy/blob/v0.31.0/packages/server/src/services/patch-repo.ts#L84-L90 technical-description
- VulnCheck Advisory: Dokploy 0.28.0 before 0.31.1 Path Traversal via patch.readRepoDirectories repoPath third-party-advisory