Servers and applications
GHSA-87rx-r765-9c93
Path traversal in `appName` on the `/listen-docker-stats-monitoring` WebSocket lets a low-privileged member create arbitrary directories and write files as root on the Docker host
- Severity
- Critical 9.1
- Published
- 12 Nov 2026
- Last changed
- 12 Nov 2026
- Added to UpHeron
- 12 Nov 2026
- Fixed in
- 0.31.1
- Weakness
- Path traversal (CWE-22)
- Attack
- Over the network · Needs a user account · No user action needed
- Attacker can
- Read some data · Change data · Slow it down
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L- Sources
- Project advisories (GitHub)
Description
The WebSocket endpoint /listen-docker-stats-monitoring accepts an appName query parameter that is never validated or normalized. It is interpolated directly into a filesystem path that is then passed to mkdir(..., { recursive: true }) and writeFile(...).
Combined with a missing runtime validation on appType and a broken authorization-to-object binding, a low-privileged organization member can create directories and write files as root on the Docker host, outside the intended MONITORING_PATH — including into the directory Traefik watches for dynamic configuration.
The primary defect is a path traversal (CWE-22)​; the authorization weakness on this endpoint is reported here as a secondary issue, not as the main claim.
There is no path.resolve() containment check, no character whitelist, and no rejection of .. anywhere between the query parameter and the sink.
Affected software
| Software | Affected versions |
|---|---|
DokployServers and applications · github:dokploy/dokploy |
|
References
- GitHub Advisory Database https://github.com/advisories/GHSA-87rx-r765-9c93
- github.com https://github.com/Dokploy/dokploy/security/advisories/GHSA-87rx-r765-9c93