CVE-2026-82954: Path Traversal in Dokploy

This vulnerability exists in Dokploy up to version 0.29.7 within the writeTraefikConfigInPath function of the Settings component (file packages/server/src/utils/traefik/application.ts). An attacker can remotely manipulate the path argument to perform path traversal, potentially accessing or modifying unauthorized files. The vulnerability has a CVSS 4.0 score of 9.4 (critical) indicating high impact and ease of exploitation. Although the vendor was contacted, no remediation or patch has been released. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation allows remote attackers to perform path traversal, potentially leading to unauthorized file access or modification on the affected system. Given the critical CVSS score and public exploit availability, this vulnerability poses a significant security risk to affected Dokploy installations.

No official patch or remediation is currently available from the vendor. Users should monitor vendor communications for updates. Until a fix is released, consider restricting network access to the vulnerable service and applying compensating controls to limit exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.