GHSA-gv94-wp2p-75p6

The AI-provider tRPC procedures ai.getModels and ai.testConnection are gated only by protectedProcedure (valid session; no role or permission check — every other procedure in the same router uses adminProcedure) and pass a fully user-controlled apiUrl into server-side HTTP requests with no URL validation, scheme allowlist, or private-IP filtering. Any authenticated user — including the lowest-privilege default member organization role — can make the Dokploy server send requests to arbitrary internal URLs and read the responses.

• ai.getModels: GET to ${apiUrl}/models (or /api/tags when the URL contains ollama, /models?key= for gemini). On success the parsed model list is returned to the caller; on any non-2xx the raw upstream body is reflected verbatim in the error (Failed to fetch models: ) — full-read exfiltration of any content type.