CVE-2026-128328

EUVD-2026-125049
Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to list tracked files of any git repository by supplying an arbitrary repoPath to patch.readRepoDirectories. Attackers with read access to one service can enumerate file and directory names of other tenants' application and compose source trees on the host or managed servers.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 38.6%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
dokploydokploy
0.28.0 ≤
𝑥
< 0.31.1
CNA
Common Weakness Enumeration
References
https://github.com/Dokploy/dokploy/blob/v0.31.0/apps/dokploy/server/api/routers/patch.ts#L181-L202
https://github.com/Dokploy/dokploy/blob/v0.31.0/packages/server/src/services/patch-repo.ts#L84-L90
https://github.com/Dokploy/dokploy/commit/4b582856b36a0d037ff43ecbed2026d93f22ecc6
https://github.com/Dokploy/dokploy/pull/5899
https://github.com/Dokploy/dokploy/releases/tag/v0.31.1
https://github.com/Dokploy/dokploy/security/advisories/GHSA-q7cq-vxv7-449c
https://www.vulncheck.com/advisories/dokploy-0.28.0-before-0.31.1-path-traversal-via-patch-readrepodirectories-repopath
https://github.com/Dokploy/dokploy/security/advisories/GHSA-q7cq-vxv7-449c