{"id":"CVE-2026-128329","kind":"vulnerability","aliases":["CVE-2026-128329"],"related":[],"title":"Dokploy: path traversal lets org members read arbitrary server files","description":"Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to read arbitrary files by supplying ../ sequences in the filePath of patch.readRepoFile. Attackers with service read permission can read /etc/shadow, SSH private keys, and secret environment files on the Dokploy host or managed remote servers.","summary":"Dokploy versions 0.28.0 before 0.31.1 let authenticated organization members read arbitrary files by supplying ../ sequences in the filePath of patch.readRepoFile. An attacker with service read permission can read files such as /etc/shadow, SSH private keys and secret environment files on the Dokploy host or managed remote servers.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dokploy","other","self-hosted","ssh"],"not_affected_if":["version-0.31.1-or-later"],"how_to_check":"- Check the installed Dokploy version; affected range is `0.28.0` up to but not including `0.31.1`.\n- Review which organization members have service read permission, since they are the ones who can reach the flawed endpoint.","fix":"- Dokploy: upgrade to `0.31.1` or later.","status":"open","published_at":"2026-11-13T10:18:12+00:00","first_seen_at":"2026-11-13T10:47:33+00:00","triaged_at":"2026-11-13T10:51:04+00:00","updated_at":"2026-11-13T10:51:04+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T10:51:04Z","model":"claude-haiku-5-5","output":{"fix":"- Dokploy: upgrade to `0.31.1` or later.","reach":"network","title":"Dokploy: path traversal lets org members read arbitrary server files","impact":"high","summary":"Dokploy versions 0.28.0 before 0.31.1 let authenticated organization members read arbitrary files by supplying ../ sequences in the filePath of patch.readRepoFile. An attacker with service read permission can read files such as /etc/shadow, SSH private keys and secret environment files on the Dokploy host or managed remote servers.","audience":"businesses","category":"other","nicknames":[],"who_cares":["dokploy","self-hosted","ssh"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Secrets and SSH keys on host and remote servers readable","analyst_note":"Product ecosystem and exact affected endpoint behavior could be confirmed from the vendor advisory.","how_to_check":"- Check the installed Dokploy version; affected range is `0.28.0` up to but not including `0.31.1`.\n- Review which organization members have service read permission, since they are the ones who can reach the flawed endpoint.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-0.31.1-or-later"],"who_is_affected":"Teams that self-host Dokploy between versions 0.28.0 and 0.31.1 and have organization members with service read permission. Per the sources, the flaw is reached through patch.readRepoFile, and it exposes files on the Dokploy host and on managed remote servers. Instances already on 0.31.1 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000763,"input_tokens":4661,"output_tokens":594,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-128329':13A,16A '-2026':12A,15A '/etc/shadow':54B,103C '0.28.0':25B,71C '0.31.1':27B,73C 'allow':80C 'arbitrari':8A,33B,86C 'attack':44B,96C 'authent':29B,81C 'contain':74C 'cve':11A,14A 'dokploy':1A,17B,23B,64B,70C,113C 'environ':60B,109C 'file':10A,34B,51B,61B,87C,110C 'filepath':40B,93C 'host':21B,65B,114C 'key':57B,106C 'let':4A,28B 'manag':67B,116C 'member':6A,31B,83C 'org':5A 'organ':30B,82C 'patch.readrepofile':42B,95C 'path':2A,76C 'permiss':48B,100C 'privat':56B,105C 'read':7A,32B,47B,50B,85C,99C,102C 'remot':68B,117C 'secret':59B,108C 'self':20B 'self-host':19B 'sequenc':37B,90C 'server':9A,69B,118C 'servic':46B,98C 'ssh':22B,55B,104C 'suppli':36B,89C 'travers':3A,77C 'version':24B 'vulner':78C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Dokploy between versions 0.28.0 and 0.31.1 and have organization members with service read permission. Per the sources, the flaw is reached through patch.readRepoFile, and it exposes files on the Dokploy host and on managed remote servers. Instances already on 0.31.1 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dokploy","high","other","selfhosted","ssh"],"campaign_type":null,"search_a":"'-128329':13A,16A '-2026':12A,15A 'arbitrari':8A 'cve':11A,14A 'dokploy':1A 'file':10A 'let':4A 'member':6A 'org':5A 'path':2A 'read':7A 'server':9A 'travers':3A","search_b":"'/etc/shadow':54B '0.28.0':25B '0.31.1':27B 'arbitrari':33B 'attack':44B 'authent':29B 'dokploy':17B,23B,64B 'environ':60B 'file':34B,51B,61B 'filepath':40B 'host':21B,65B 'key':57B 'let':28B 'manag':67B 'member':31B 'organ':30B 'patch.readrepofile':42B 'permiss':48B 'privat':56B 'read':32B,47B,50B 'remot':68B 'secret':59B 'self':20B 'self-host':19B 'sequenc':37B 'server':69B 'servic':46B 'ssh':22B,55B 'suppli':36B 'version':24B","search_c":"'/etc/shadow':103C '0.28.0':71C '0.31.1':73C 'allow':80C 'arbitrari':86C 'attack':96C 'authent':81C 'contain':74C 'dokploy':70C,113C 'environ':109C 'file':87C,110C 'filepath':93C 'host':114C 'key':106C 'manag':116C 'member':83C 'organ':82C 'patch.readrepofile':95C 'path':76C 'permiss':100C 'privat':105C 'read':85C,99C,102C 'remot':117C 'secret':108C 'sequenc':90C 'server':118C 'servic':98C 'ssh':104C 'suppli':89C 'travers':77C 'vulner':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T08:16:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128329","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128329","severity":null,"published_at":"2026-11-13T10:18:12+00:00","modified_at":"2026-11-13T10:18:12+00:00","first_seen_at":"2026-11-13T10:47:33+00:00","fetched_at":"2026-11-13T10:47:33+00:00","note":null}],"documents":[{"id":145443,"url":"https://github.com/Dokploy/dokploy/commit/40e818b0e0d8e448e7a30c559ebf4e146e5932ae","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145439,"url":"https://github.com/Dokploy/dokploy/commit/4b582856b36a0d037ff43ecbed2026d93f22ecc6","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":140888,"url":"https://github.com/Dokploy/dokploy/releases/tag/v0.31.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":145446,"url":"https://github.com/Dokploy/dokploy/security/advisories/GHSA-g6rj-m32j-2mc4","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-12T08:16:46+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145447,"url":"https://www.vulncheck.com/advisories/dokploy-0.28.0-before-0.31.1-path-traversal-via-patch-readrepofile","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}