Dokploy <=0.29.7 Vulnerability: Path Traversal Exploit in Wild
- Severity
- CRITICAL
- CVSS
- 9.9
- Affected component
- dokploy (npm)
- Patched version
- Not yet available
A critical vulnerability has been detected in Dokploy versions up to 0.29.7. This issue allows for remote path traversal attacks.
What happened
An exploit has been detected in Dokploy versions up to 0.29.7. This vulnerability affects the function writeTraefikConfigInPath in the file packages/server/src/utils/traefik/application.ts of the Settings component. The manipulation of the argument path results in path traversal. This exploit is now public and may be used by attackers. It is recommended to upgrade Dokploy to a version beyond 0.29.7 and review configurations for any unauthorized access.
The vulnerability was first flagged on 2026-08-31T22:17:34.080000+00:00 and is tracked under CVE-2026-82954 with a CVSS score of 9.9. The exploit is reportedly being used in the wild.
What to do about it
- Upgrade Dokploy to a version beyond 0.29.7.
- Review your configurations for any unauthorized access.
- Monitor the primary sources for updates on the vulnerability.
- Implement additional security measures to protect against path traversal attacks.
How 0Day would have caught this
dokploy is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using Dokploy version 0.29.7 or earlier, you are affected.
What should I do right now?
Upgrade Dokploy to a version beyond 0.29.7 and review your configurations for any unauthorized access.
Has this been exploited in the wild?
Yes, the exploit is reportedly being used in the wild.