Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
CVE-2026-82954: Dokploy lets attackers read/write arbitrary server files
CVE-2026-82954 · published 2 days ago
Summary
Versions of Dokploy up to 0.29.7 let a remote user change a setting so the system writes files in locations you didn’t intend. This can give an attacker the ability to view or alter any file on the server. Upgrade to the latest Dokploy release or apply the vendor’s patch, and restrict external access to the management interface.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| – | dokploy | 0.29.0 |
Original advisory text
A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the function writeTraefikConfigInPath of the file packages/server/src/utils/traefik/application.ts of the component Settings...
A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the function writeTraefikConfigInPath of the file packages/server/src/utils/traefik/application.ts of the component Settings. The manipulation of the argument path results in path traversal. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
References
- https://vuldb.com/vuln/397303 vdb-entry technical-description
- https://vuldb.com/vuln/397303/cti signature permissions-required
- https://vuldb.com/cve/CVE-2026-82954 third-party-advisory
- https://vuldb.com/submit/879844 third-party-advisory
Severity
8.6
High
CVSS 3.1: 9.9 (MITRE)
Exploitation
EPSS <1%
Type
CWE-22Path Traversal
Timeline
Published31 Aug 2026
Updated2 Sep 2026
First seen31 Aug 2026
Monitor software like this
Free during beta