CVE-2026-128328
Dokploy 0.28.0 before 0.31.1 Path Traversal via patch.readRepoDirectories repoPath
CVSS Score
5.0
EPSS Score
0.0%
EPSS Percentile
0th
Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to list tracked files of any git repository by supplying an arbitrary repoPath to patch.readRepoDirectories. Attackers with read access to one service can enumerate file and directory names of other tenants' application and compose source trees on the host or managed servers.
| CWE | CWE-22 |
| Vendor | dokploy |
| Product | dokploy |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for dokploy dokploy
Be the first to know when new medium vulnerabilities affecting dokploy dokploy are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
Dokploy / dokploy
0.28.0 < 0.31.1
References
github.com: https://github.com/Dokploy/dokploy/security/advisories/GHSA-q7cq-vxv7-449c github.com: https://github.com/Dokploy/dokploy/commit/4b582856b36a0d037ff43ecbed2026d93f22ecc6 github.com: https://github.com/Dokploy/dokploy/pull/5899 github.com: https://github.com/Dokploy/dokploy/releases/tag/v0.31.1 github.com: https://github.com/Dokploy/dokploy/blob/v0.31.0/apps/dokploy/server/api/routers/patch.ts#L181-L202 github.com: https://github.com/Dokploy/dokploy/blob/v0.31.0/packages/server/src/services/patch-repo.ts#L84-L90 vulncheck.com: https://www.vulncheck.com/advisories/dokploy-0.28.0-before-0.31.1-path-traversal-via-patch-readrepodirectories-repopath
Credits
Sandipkumar sah Mauricio Siu