Description

A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the function writeTraefikConfigInPath of the file packages/server/src/utils/traefik/application.ts of the component Settings. The manipulation of the argument path results in path traversal. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-31T22:17:34.080Z",
  "pubdate": "2026-08-31T22:17:34.080Z",
  "executiveSummary": "A path traversal vulnerability exists in Dokploy versions up to 0.29.7, specifically within the Settings component.\nThe flaw resides in the writeTraefikConfigInPath function located in packages/server/src/utils/traefik/application.ts.\nBy manipulating the 'path' argument, a remote, unauthenticated attacker can perform arbitrary file system operations, potentially leading to unauthorized file read/write access outside the intended directory scope.\nThis vulnerability poses a critical risk to system integrity, as it may allow for configuration tampering, sensitive data exposure, or the injection of malicious settings into the Traefik proxy configuration.\nThe attack vector is remotely exploitable, and public exploit code is available, increasing the urgency for defensive action.\nGiven the vendor's lack of response, users should consider this a high-priority exposure requiring immediate internal security controls or compensatory measures.",
  "technicalDetails": "The vulnerability is classified as an improper limitation of a pathname to a restricted directory (Path Traversal). The root cause is the insufficient validation and sanitization of the 'path' parameter passed to the 'writeTraefikConfigInPath' function within 'packages/server/src/utils/traefik/application.ts'.\nIn the affected versions of Dokploy (up to 0.29.7), the application logic trusts user-supplied input to determine the file path for writing Traefik configurations. The function fails to effectively neutralize directory traversal sequences (e.g., '../') or check if the target path resolves to a directory outside of the intended, secure base path.\nThe attack flow commences with a remote attacker identifying an endpoint that triggers the 'writeTraefikConfigInPath' utility. The attacker crafts a request containing a malicious payload in the 'path' argument, utilizing dot-dot-slash notation to navigate upwards from the application's designated configuration directory. Because the application processes this path without restriction, the underlying system call writes the configuration data to a location of the attacker's choosing.\nExploitation allows for several post-exploitation scenarios. An attacker could overwrite critical system configuration files, inject malicious Traefik rules to redirect traffic to unauthorized endpoints, or perform a Denial of Service (DoS) by corrupting essential application files. Since Traefik acts as the edge router for the Dokploy environment, compromising its configuration provides an attacker with significant leverage over the traffic flow and security posture of the entire deployment.\nThe vulnerability is remotely exploitable, meaning an attacker does not require physical access or local user privileges to initiate the attack. The lack of robust input validation at the application layer is the primary failure point. There is no indication that specialized authentication or specific user roles mitigate this flaw; therefore, if the vulnerable endpoint is exposed to the network, it is susceptible to unauthorized manipulation.\nAs of the current assessment, no official vendor patch has been provided. The combination of public exploit availability and the sensitive nature of the configuration file being manipulated makes this a high-risk entry point for broader system compromise."
}