UpHeron
All vulnerabilities

Servers and applications

CVE-2026-128328

Dokploy 0.28.0 before 0.31.1 Path Traversal via patch.readRepoDirectories repoPath

Severity
Medium 5.3
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
0.31.1
Weakness
Path traversal (CWE-22)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read some data
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Sources
CVE Program

Description

Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to list tracked files of any git repository by supplying an arbitrary repoPath to patch.readRepoDirectories. Attackers with read access to one service can enumerate file and directory names of other tenants' application and compose source trees on the host or managed servers.

From the CVE Program.

Affected software

SoftwareAffected versions
DokployServers and applications · cna:dokploy|dokploy
  • From 0.28.0 before 0.31.1

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-128328