GHSA-wcp5-g62q-jfr9

• Project: Dokploy
• Version: v0.29.4
• Severity: Critical (9.1)
• Vulnerability Type: Path Traversal (CWE-22) / RCE

The unzipDrop utility, used for "Drop" deployments, attempts to prevent path traversal but uses a flawed validation mechanism. The readValidDirectory function uses a weak regular expression that allows . and / characters. Furthermore, it validates that the resolved path starts with the base directory /etc/dokploy, but it does not restrict the path to the specific application's deployment directory. This allows an attacker to write files anywhere within /etc/dokploy, including sensitive locations like the schedules directory.

Remote Code Execution. An attacker can overwrite system configurations, hijack other applications, or achieve persistent RCE by manipulating scheduled tasks.