A critical path traversal vulnerability in Dokploy allows authenticated attackers to execute arbitrary file operations, posing a severe risk to system integrity and confidentiality.

This vulnerability is a path traversal flaw (CWE-22) located in the writeTraefikConfigInPath function within the Settings component. An attacker with low-level privileges can manipulate the path argument to access or overwrite sensitive files outside the intended directory.

The ability to perform path traversal represents a critical security failure, as it can lead to unauthorized access to configuration files, credential theft, or full remote code execution. Given the CVSS score of 9.9, the impact on system integrity, confidentiality, and availability is catastrophic. Organizations utilizing Dokploy face significant risks of data breaches and complete server compromise if this vulnerability is leveraged.

Immediate Action: Since no specific patch version is documented, users should restrict administrative access to the Dokploy interface and monitor for suspicious file system activity until the vendor provides a security update.

Proactive Monitoring: Security teams should monitor server access logs for unusual path strings or attempts to access restricted directories, particularly those involving the Traefik configuration files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block path traversal patterns, such as sequences containing directory traversal characters.

Public Exploit Available: Yes — a public exploit has been identified and is documented in the referenced vulnerability database.

The severity of this vulnerability, combined with the availability of public exploit information, necessitates immediate defensive action. Administrators should audit their Dokploy instances and apply the latest available updates as soon as they are released by the vendor. Prioritize isolating affected systems from external networks until a verified fix is implemented to prevent unauthorized access.