Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the apiCreateCertificate schema in packages/server/src/db/schema/certificate.ts accepts a client-supplied certificatePath, and packages/server/src/services/certificate.ts joins that value to the certificate root without confinement. An authenticated user with certificate create or delete permission can use certificatePath to write attacker-controlled certificate content outside the intended directory or delete an out-of-root directory. This vulnerability is fixed in 0.29.13.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-10T20:17:34.560Z",
  "pubdate": "2026-08-10T20:17:34.560Z",
  "executiveSummary": "An arbitrary file write and delete vulnerability exists in Dokploy prior to version 0.29.13. The vulnerability stems from improper input validation and path handling within the certificate management subsystem. Specifically, the apiCreateCertificate schema accepts a client-supplied certificatePath that is subsequently concatenated directly to the certificate root directory without adequate confinement or path sanitization. An authenticated attacker possessing certificate creation or deletion permissions can exploit this flaw to supply maliciously crafted directory traversal sequences within the certificatePath parameter. This enables the capability to write arbitrary attacker-controlled certificate content to arbitrary locations outside the intended storage directory, or alternatively, to delete files and directories located in out-of-root filesystem locations. The risk implications include potential system compromise, arbitrary data manipulation, and unauthorized deletion of critical filesystem resources. Successful exploitation requires prior authentication with specific functional permissions and interacts with the server-side API endpoints responsible for certificate provisioning and management.",
  "technicalDetails": "The vulnerability resides within the packages/server/src/db/schema/certificate.ts and packages/server/src/services/certificate.ts components of Dokploy prior to version 0.29.13. The root cause of the issue is an absolute or relative path traversal flaw resulting from unsafe path concatenation. The apiCreateCertificate input validation schema accepts a client-supplied string parameter designated as certificatePath. During the execution flow within packages/server/src/services/certificate.ts, this untrusted input is directly appended to the application's base certificate root directory without performing canonicalization or validating that the resulting target path remains strictly within the intended boundaries of the root directory.\nThe attack flow proceeds as follows: First, an attacker authenticates to the Dokploy platform with valid credentials that grant them permissions to create or delete certificates. Second, the attacker initiates an API request to create or delete a certificate, supplying a crafted payload containing directory traversal sequences (such as dot-dot-slash sequences or absolute paths) within the certificatePath field. Third, the backend service processes the request by programmatically joining the untrusted certificatePath value with the internal certificate storage root. Because the application fails to confine the resulting path or neutralize traversal sequences, the filesystem operations interact with resources residing entirely outside the designated storage directory.\nWhen exploiting the file write vector, the payload behavior allows the attacker to write arbitrary certificate data to sensitive filesystem locations, potentially overwriting configuration files or application binaries depending on the privileges of the underlying Node.js process. When exploiting the file delete vector, the lack of path confinement allows the deletion of arbitrary directories and files accessible to the application context. The vulnerability is mitigated in version 0.29.13 through proper input sanitization, path validation, and confinement controls that ensure all operations remain restricted to the designated certificate root directory."
}