UpHeron
All vulnerabilities

Servers and applications

GHSA-g6rj-m32j-2mc4

Arbitrary File Read via Path Traversal in `patch.readRepoFile`

Severity
High 7.7
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
0.31.1
Weakness
Path traversal (CWE-22)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Sources
Project advisories (GitHub)

Description

The patch.readRepoFile tRPC endpoint allows any authenticated user with service read permission to read arbitrary files from the server filesystem via path traversal in the filePath parameter. The file path is joined using path.join() which resolves ../ components, enabling escape from the intended patch repository directory. This exposes sensitive files including SSH private keys, environment variables with API keys, and system credentials.

The readRepoFile endpoint (apps/dokploy/server/api/routers/patch.ts:204-241) accepts a filePath parameter with no path traversal validation:

The readPatchRepoFile function (packages/server/src/services/patch-repo.ts:148-181) uses path.join() to construct the full file path, which resolves ../ components:

When filePath is ../../../../../../etc/shadow:

  • repoPath = /var/lib/dokploy/patch-repos/application/my-app
  • fullPath = path.join(repoPath, "../../../../../../etc/shadow") resolves to /etc/shadow
From Dokploy/dokploy's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.31.1

References