Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated attacker can read any file that the Traefik process user can access (e.g., /etc/passwd, application source, environment variable files containing credentials and secrets). This may lead to full compromise of other services or lateral movement. This vulnerability is fixed in 0.23.7.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/Dokploy/dokploy/commit/e42f6bc61050cd438726921fced64477cbf8f8e6 Patch
- https://github.com/Dokploy/dokploy/security/advisories/GHSA-vq94-qm94-mxp6 Patch, Third Party Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 4.9 · dokployNVD modified 2026-10-19 17:10
Affected (CPE criteria) 1
cpe:2.3:a:dokploy:dokploy:*:*:*:*:*:*:*:*