UpHeron
All vulnerabilities

Servers and applications

CVE-2026-128329

Dokploy 0.28.0 before 0.31.1 Path Traversal via patch.readRepoFile

Severity
High 8.3
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
0.31.1
Weakness
Path traversal (CWE-22)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read data
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Sources
CVE Program

Description

Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to read arbitrary files by supplying ../ sequences in the filePath of patch.readRepoFile. Attackers with service read permission can read /etc/shadow, SSH private keys, and secret environment files on the Dokploy host or managed remote servers.

From the CVE Program.

Affected software

SoftwareAffected versions
DokployServers and applications · cna:dokploy|dokploy
  • From 0.28.0 before 0.31.1

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-128329