UpHeron
All vulnerabilities

Servers and applications

GHSA-h8q2-p3w4-m3mr

Dokploy Drop deployment ZIP traversal can overwrite global Traefik dynamic routing configuration

Severity
Critical 9.1
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
0.31.1
Weakness
Path traversal (CWE-22)CWE-73Improper access control (CWE-284)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read some data · Change data · Slow it down
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
Sources
Project advisories (GitHub)

Description

Dokploy 0.29.13 Drop deployments extract attacker-supplied ZIP entries under an application code directory, but the path validation only checks that the resolved path remains under Dokploy's global base path.

As a result, a member user assigned to one application can upload a ZIP entry such as:

The entry escapes the assigned application's code directory and writes a global Traefik dynamic configuration file.

In my proof, that file defines a higher-priority router for another hostname. Traefik loads the written file and routes traffic for the victim hostname to the attacker's backend.

Relevant source locations in Dokploy 0.29.13:

  • packages/server/src/utils/builders/drop.ts:24: the expected extraction base is //code.
  • packages/server/src/utils/builders/drop.ts:56: the ZIP entry name becomes filePath.
  • packages/server/src/utils/builders/drop.ts:68: fullPath = path.join(outputPath, filePath).
From Dokploy/dokploy's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.31.1

References