Threats tagged 'ghsa-64h2-7cqr-4fm3'

Dokploy versions from 0.28.0 up to but not including 0.31.1 contain a path traversal vulnerability. This flaw allows authenticated organization members with service read permission to read arbitrary files on the Dokploy host or managed remote servers by using '../' sequences in the filePath parameter of the patch.readRepoFile function. Sensitive files such as /etc/shadow, SSH private keys, and secret environment files can be accessed, potentially exposing critical secrets.