EUVD-2025-20274Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated attacker can read any file that the Traefik process user can access (e.g., /etc/passwd, application source, environment variable files containing credentials and secrets). This may lead to full compromise of other services or lateral movement. This vulnerability is fixed in 0.23.7.
Analysis
Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated attacker can read any file that the Traefik process user can access (e.g., /etc/passwd, application source, environment variable files containing credentials and secrets). This may lead to full compromise of other services or lateral movement. This vulnerability is fixed in 0.23.7.
Technical ContextAI
Path traversal allows an attacker to access files outside the intended directory by manipulating file paths with sequences like '../'.
RemediationAI
A vendor patch is available — apply it immediately. Validate and sanitize file path inputs. Use a whitelist of allowed files or directories. Implement chroot jails or containerization.
Dokploy self-hosted PaaS prior to 0.26.6 has a critical command injection vulnerability (CVSS 9.9) allowing authenticate
Dokploy versions before 0.26.6 contain hardcoded database credentials in the installation script, causing nearly all dep
Command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated low-privilege member run arbitrary
Command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated panel user run arbitrary commands o
Remote code execution in Dokploy 0.27.0 through 0.29.2 allows unauthenticated attackers to forge email-verification JWTs
Command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user run arbitrary OS commands on
OS command injection in Dokploy self-hosted PaaS before 0.29.13 lets an authenticated member with service-deployment per
Command injection in Dokploy self-hostable PaaS before 0.29.13 lets an authenticated user with backup:read permission ru
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
OS command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user holding the backup-restor
Cross-tenant remote command execution in Dokploy (self-hosted PaaS) before 0.29.13 lets any authenticated user holding o
Command injection in Dokploy self-hosted PaaS versions prior to 0.29.13 lets an authenticated user with database-service
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today