PT-2025-28203 · Dokploy · Dokploy
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
Dokploy versions prior to 0.23.7
Description:
Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated attacker can read any file that the Traefik process user can access, such as
/etc/passwd, application source, environment variable files containing credentials and secrets. This may lead to full compromise of other services or lateral movement.Recommendations:
For versions prior to 0.23.7, update to version 0.23.7 to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and environment variables to minimize the risk of exploitation.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Dokploy