NPM · AUGUST 2026 · EARLY WARNING

Dokploy <=0.29.7 Vulnerability: Path Traversal Exploit in Wild

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
Severity
CRITICAL
CVSS
9.9
Affected component
dokploy (npm)
Patched version
Not yet available
CVE-2026-82954

A critical vulnerability has been detected in Dokploy versions up to 0.29.7. This issue allows for remote path traversal attacks.

What happened

An exploit has been detected in Dokploy versions up to 0.29.7. This vulnerability affects the function writeTraefikConfigInPath in the file packages/server/src/utils/traefik/application.ts of the Settings component. The manipulation of the argument path results in path traversal. This exploit is now public and may be used by attackers. It is recommended to upgrade Dokploy to a version beyond 0.29.7 and review configurations for any unauthorized access.

The vulnerability was first flagged on 2026-08-31T22:17:34.080000+00:00 and is tracked under CVE-2026-82954 with a CVSS score of 9.9. The exploit is reportedly being used in the wild.

What to do about it

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If dokploy is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

If you are using Dokploy version 0.29.7 or earlier, you are affected.

What should I do right now?

Upgrade Dokploy to a version beyond 0.29.7 and review your configurations for any unauthorized access.

Has this been exploited in the wild?

Yes, the exploit is reportedly being used in the wild.

Sources

Join the 0Day waitlist →

← Back to all threats