UpHeron
All vulnerabilities

Servers and applications

GHSA-q7cq-vxv7-449c

Authenticated directory traversal in `patch.readRepoDirectories` lets any member enumerate the file tree of any git repository on the host, including other tenants' source

Severity
Medium 5.0
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
0.31.1
Weakness
Path traversal (CWE-22)Information exposure (CWE-200)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read some data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Sources
Project advisories (GitHub)

Description

The patch.readRepoDirectories tRPC procedure takes a repoPath string straight from the caller and runs git ls-tree inside it. The value is never confined to the caller's own patch-repo directory, so a member with read access to one service can point repoPath at any path on the host (or a managed server) and list the tracked files of the git repository there — for example another organization's deployed application source under /etc/dokploy/applications//code. It is cross-tenant information disclosure of directory and file names.

From apps/dokploy/server/api/routers/patch.ts:

And the sink in packages/server/src/services/patch-repo.ts:

repoPath is attacker-controlled and absolute. quote() (added for GHSA-56g6, which was a command-injection issue in this same function) blocks shell metacharacters, but the directory itself is still whatever the caller asks for.

From Dokploy/dokploy's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.31.1

References