GHSA-5qmc-4xhw-j6vp

Any authenticated Dokploy user can inject arbitrary Traefik router rules by setting their application domain's host or path to a value containing backtick or pipe characters. Because Traefik routing rules are applied globally, the injected rule can match traffic destined for other users' applications on the same Dokploy instance, enabling cross-tenant traffic interception.

File: packages/server/src/utils/traefik/domain.ts

Vector A — host field via toPunycode() catch fallback (line ~84, ~92):

The backtick character () is a WHATWG "forbidden domain code point," so new URL("http://evil\host") throws a TypeError. The catch block returns the raw, unmodified host` string — including the injected backtick. That string is then interpolated directly into the Traefik router rule.

The path field is interpolated with no validation:

Only min(1) and trim-check. No character allowlist. Backticks, pipes, and parentheses all pass validation and reach the Traefik config.