UpHeron
All vulnerabilities

Servers and applications

GHSA-gxcw-hpm8-vq4m

Server-Side Request Forgery (SSRF) via Template baseUrl Parameter

Severity
High 7.7
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
0.31.1
Weakness
Server-side request forgery (CWE-918)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Sources
Project advisories (GitHub)

Description

Three tRPC endpoints in Dokploy's compose router (compose.templates, compose.getTags, compose.deployTemplate) accept a user-controlled baseUrl parameter that gets passed directly to server-side fetch() calls with no URL validation, no protocol restriction, and no private IP blocking. Any authenticated user can make the Dokploy server send HTTP requests to arbitrary internal or external URLs, allowing access to cloud metadata services (AWS/GCP/Azure), internal network services, and other resources that should not be reachable from the application.

The three vulnerable endpoints all accept baseUrl as z.string().optional() with no further validation:

apps/dokploy/server/api/routers/compose.ts:

The user-supplied baseUrl goes directly into fetch() in packages/server/src/templates/github.ts:

The fetch URL appends a fixed path like /meta.json, but the attacker can neutralize this using a query string.

From Dokploy/dokploy's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.31.1

References