---
id: "CVE-2026-128328"
page: "https://infrastack.ai/live/CVE-2026-128328"
kind: "vulnerability"
aliases: ["CVE-2026-128328"]
title: "Dokploy: path traversal lets members list files in other repositories"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Dokploy", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["dokploy", "multi-tenant", "runtime", "self-hosted"]
not_affected_if: ["single-tenant", "version-0.31.1-or-later"]
published_at: "2026-11-13T10:18:12+00:00"
first_seen_at: "2026-11-13T10:47:33+00:00"
updated_at: "2026-11-13T10:57:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-128328", "first_seen_at": "2026-11-13T10:47:33+00:00"}]
exploit_sources: []
---

# Dokploy: path traversal lets members list files in other repositories

Link for people: https://infrastack.ai/live/CVE-2026-128328 (this .md is for agents)

Dokploy versions 0.28.0 before 0.31.1 let an authenticated organization member pass an arbitrary repository path to the patch.readRepoDirectories function. An attacker can list file and directory names in git repositories belonging to other tenants on the host.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Dokploy affected range not listed fixed no fixed version listed

## Fix

- Dokploy: move to `0.31.1` or later.

## Timeline

- 2026-11-13T10:47:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-128328

## Documents

- [advisory] Vendor advisory: github.com https://github.com/Dokploy/dokploy/security/advisories/GHSA-q7cq-vxv7-449c
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/dokploy-0.28.0-before-0.31.1-path-traversal-via-patch-readrepodirectories-repopath
- [fix] Patch: github.com https://github.com/Dokploy/dokploy/commit/4b582856b36a0d037ff43ecbed2026d93f22ecc6
- [fix] Release notes: github.com https://github.com/Dokploy/dokploy/releases/tag/v0.31.1

## From the sources

Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to list tracked files of any git repository by supplying an arbitrary repoPath to patch.readRepoDirectories. Attackers with read access to one service can enumerate file and directory names of other tenants' application and compose source trees on the host or managed servers.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_