{"id":"CVE-2026-128328","kind":"vulnerability","aliases":["CVE-2026-128328"],"related":[],"title":"Dokploy: path traversal lets members list files in other repositories","description":"Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to list tracked files of any git repository by supplying an arbitrary repoPath to patch.readRepoDirectories. Attackers with read access to one service can enumerate file and directory names of other tenants' application and compose source trees on the host or managed servers.","summary":"Dokploy versions 0.28.0 before 0.31.1 let an authenticated organization member pass an arbitrary repository path to the patch.readRepoDirectories function. An attacker can list file and directory names in git repositories belonging to other tenants on the host.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Dokploy","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dokploy","multi-tenant","runtime","self-hosted"],"not_affected_if":["single-tenant","version-0.31.1-or-later"],"how_to_check":null,"fix":"- Dokploy: move to `0.31.1` or later.","status":"open","published_at":"2026-11-13T10:18:12+00:00","first_seen_at":"2026-11-13T10:47:33+00:00","triaged_at":"2026-11-13T10:57:03+00:00","updated_at":"2026-11-13T10:57:03+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-13T10:57:03Z","model":"claude-haiku-5-5","output":{"fix":"- Dokploy: move to `0.31.1` or later.","reach":"network","title":"Dokploy: path traversal lets members list files in other repositories","impact":"low","summary":"Dokploy versions 0.28.0 before 0.31.1 let an authenticated organization member pass an arbitrary repository path to the patch.readRepoDirectories function. An attacker can list file and directory names in git repositories belonging to other tenants on the host.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["dokploy","self-hosted","multi-tenant"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker lists file names in other tenants' repositories on the host","analyst_note":"","how_to_check":"- Check the installed Dokploy version in the deployed instance or image tag, e.g. `0.28.0` to `0.31.0` is affected.\n- Confirm whether multiple organizations or tenants share the same Dokploy host.","plain_action":"","product_name":"Dokploy","needs_analyst":false,"not_affected_if":["single-tenant","version-0.31.1-or-later"],"who_is_affected":"Dokploy instances running versions 0.28.0 through 0.31.0 where more than one organization shares the host or managed servers. Attackers need a member account in an organization with read access to a service. Single-tenant installs with only trusted members are lower risk.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000736,"input_tokens":4647,"output_tokens":542,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-128328':13A,16A '-2026':12A,15A '0.28.0':28B,64C '0.31.1':30B,66C 'access':95C 'allow':73C 'applic':108C 'arbitrari':38B,88C 'attack':46B,92C 'authent':33B,74C 'belong':56B 'compos':110C 'contain':67C 'cve':11A,14A 'directori':51B,103C 'dokploy':1A,17A,18B,26B,63C 'enumer':100C 'file':7A,49B,80C,101C 'function':44B 'git':54B,83C 'host':25B,62B,115C 'let':4A,31B 'list':6A,48B,78C 'manag':117C 'member':5A,35B,76C 'multi':20B 'multi-ten':19B 'name':52B,104C 'one':97C 'organ':34B,75C 'pass':36B 'patch.readrepodirectories':43B,91C 'path':2A,40B,69C 'read':94C 'repopath':89C 'repositori':10A,39B,55B,84C 'runtim':22B 'self':24B 'self-host':23B 'server':118C 'servic':98C 'sourc':111C 'suppli':86C 'tenant':21B,59B,107C 'track':79C 'travers':3A,70C 'tree':112C 'version':27B 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Dokploy instances running versions 0.28.0 through 0.31.0 where more than one organization shares the host or managed servers. Attackers need a member account in an organization with read access to a service. Single-tenant installs with only trusted members are lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["dokploy"],"ptokens":["dokploy"],"labels":["dokploy","medium","multitenant","runtime","selfhosted","vendor"],"campaign_type":null,"search_a":"'-128328':13A,16A '-2026':12A,15A 'cve':11A,14A 'dokploy':1A,17A 'file':7A 'let':4A 'list':6A 'member':5A 'path':2A 'repositori':10A 'travers':3A","search_b":"'0.28.0':28B '0.31.1':30B 'arbitrari':38B 'attack':46B 'authent':33B 'belong':56B 'directori':51B 'dokploy':18B,26B 'file':49B 'function':44B 'git':54B 'host':25B,62B 'let':31B 'list':48B 'member':35B 'multi':20B 'multi-ten':19B 'name':52B 'organ':34B 'pass':36B 'patch.readrepodirectories':43B 'path':40B 'repositori':39B,55B 'runtim':22B 'self':24B 'self-host':23B 'tenant':21B,59B 'version':27B","search_c":"'0.28.0':64C '0.31.1':66C 'access':95C 'allow':73C 'applic':108C 'arbitrari':88C 'attack':92C 'authent':74C 'compos':110C 'contain':67C 'directori':103C 'dokploy':63C 'enumer':100C 'file':80C,101C 'git':83C 'host':115C 'list':78C 'manag':117C 'member':76C 'name':104C 'one':97C 'organ':75C 'patch.readrepodirectories':91C 'path':69C 'read':94C 'repopath':89C 'repositori':84C 'server':118C 'servic':98C 'sourc':111C 'suppli':86C 'tenant':107C 'track':79C 'travers':70C 'tree':112C 'vulner':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T08:14:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128328","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128328","severity":null,"published_at":"2026-11-13T10:18:12+00:00","modified_at":"2026-11-13T10:18:12+00:00","first_seen_at":"2026-11-13T10:47:33+00:00","fetched_at":"2026-11-13T10:47:33+00:00","note":null}],"documents":[{"id":145439,"url":"https://github.com/Dokploy/dokploy/commit/4b582856b36a0d037ff43ecbed2026d93f22ecc6","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":140888,"url":"https://github.com/Dokploy/dokploy/releases/tag/v0.31.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":145441,"url":"https://github.com/Dokploy/dokploy/security/advisories/GHSA-q7cq-vxv7-449c","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-12T08:14:53+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145442,"url":"https://www.vulncheck.com/advisories/dokploy-0.28.0-before-0.31.1-path-traversal-via-patch-readrepodirectories-repopath","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}