CVE-2026-128328

Dokploy versions 0.28.0 before 0.31.1 are vulnerable to a path traversal vulnerability within the patch.readRepoDirectories function. An authenticated organization member can supply an arbitrary repoPath to list tracked files of any git repository. This flaw allows an attacker with read access to...

CVE-2026-128328 Dokploy 0.28.0 before 0.31.1 Path Traversal via patch.readRepoDirectories repoPath

Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to list tracked files of any git repository by supplying an arbitrary repoPath to patch.readRepoDirectories. Attackers with read access to one service can enumerate file and directo...

CVE-2026-93425 Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe...