CVE-2026-128328

CVSS 5.3 (medium) · published 2026-11-13

Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to list tracked files of any git repository by supplying an arbitrary repoPath to patch.readRepoDirectories. Attackers with read access to one service can enumerate file and directory names of other tenants' application and compose source trees on the host or managed servers.

Weakness: CWE-22

Source: NVD CVE-2026-128328

References

• https://github.com/Dokploy/dokploy/blob/v0.31.0/apps/dokploy/server/api/routers/patch.ts#L181-L202
• https://github.com/Dokploy/dokploy/blob/v0.31.0/packages/server/src/services/patch-repo.ts#L84-L90
• https://github.com/Dokploy/dokploy/commit/4b582856b36a0d037ff43ecbed2026d93f22ecc6
• https://github.com/Dokploy/dokploy/pull/5899
• https://github.com/Dokploy/dokploy/releases/tag/v0.31.1
• https://github.com/Dokploy/dokploy/security/advisories/GHSA-q7cq-vxv7-449c
• https://www.vulncheck.com/advisories/dokploy-0.28.0-before-0.31.1-path-traversal-via-patch-readrepodirectories-repopath
• https://github.com/Dokploy/dokploy/security/advisories/GHSA-q7cq-vxv7-449c

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.