GHSA-qxjv-6cvh-32c6

Dokploy's install.sh (served from https://dokploy.com/install.sh, source apps/website/public/install.sh in the website repo) and the manual-installation docs run chmod 777 /etc/dokploy. That directory is bind-mounted into the Dokploy and Traefik containers and holds their configuration (traefik/), generated application files, scheduled-task scripts (schedules/), and application .env files.

This is a local privilege escalation to root on shared or multi-user hosts. Single-user hosts are not affected because it requires an existing non-root local account on the Dokploy host.

On Linux, write permission on a directory is enough to rename the entries inside it, including root-owned ones. Because /etc/dokploy is 0777, an unprivileged local user can move a root-owned subdirectory aside and put their own directory in its place, which Dokploy and Traefik then consume as trusted configuration.