UpHeron
All vulnerabilities

Servers and applications

GHSA-5mqv-h2xh-fvhg

Authenticated Path Traversal in 'mounts.create' 'filePath' leads to Arbitrary Root-Owned File Write on Host via Bind Mount

Severity
Critical 9.9
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
0.31.1
Weakness
Path traversal (CWE-22)Incorrect default permissions (CWE-276)Files or directories accessible to outside parties (CWE-552)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Sources
Project advisories (GitHub)

Description

An authenticated platform user (default role = "member") on Dokploy v0.29.13 and v0.29.14 can call the tRPC mutation mounts.create with type=file and a filePath parameter containing ../ sequences. The value is concatenated via path.join() with the application files base directory then written to disk as UID 0 root with no path normalization, boundary checks, or schema regex. Because /etc/dokploy/ inside the dokploy container is a Docker bind mount from the actual operator host, writes into the container's /etc/dokploy/ subtree propagate to the operator's real host filesystem as root-owned files. A single HTTP request therefore lets a regular tenant user overwrite host SSH keys, host cron files, or Dokploy's host .env secrets. Combined with the pre-existing '/var/run/docker.sock' bind inside dokploy container, this trivially escalates to full host root shell on the physical machine.

The Affected Component : createFileMount() in packages/server/src/services/mount.ts lines 81-106

From Dokploy/dokploy's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.31.1

References