CVE-2026-72880 in Dokploy
Summary
by MITRE • 08/10/2026
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the apiCreateCertificate schema in packages/server/src/db/schema/certificate.ts accepts a client-supplied certificatePath, and packages/server/src/services/certificate.ts joins that value to the certificate root without confinement. An authenticated user with certificate create or delete permission can use certificatePath to write attacker-controlled certificate content outside the intended directory or delete an out-of-root directory. This vulnerability is fixed in 0.29.13.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability identified in Dokploy versions prior to 0.29.13 represents a critical path traversal and arbitrary file manipulation flaw that undermines the application's security boundaries. This issue resides within the certificate management functionality of the platform as a service, specifically in how the system handles user-supplied certificate paths during the creation process. The vulnerability stems from insufficient input validation and path sanitization mechanisms that fail to properly constrain user-provided file paths to the intended directory structure.
The technical implementation flaw manifests in two distinct but related attack vectors within the certificate handling codebase. In packages/server/src/db/schema/certificate.ts, the apiCreateCertificate schema directly accepts a client-supplied certificatePath parameter without proper validation or sanitization. This unvalidated input is then consumed by packages/server/src/services/certificate.ts where the system performs a simple string concatenation operation to join the user-provided path with the certificate root directory. This concatenation approach creates a classic path traversal vulnerability that allows attackers to manipulate file system operations beyond the intended scope.
The operational impact of this vulnerability extends beyond simple privilege escalation, as it enables authenticated users with certificate create or delete permissions to execute arbitrary file system operations. Attackers can leverage this flaw to write malicious certificate content to directories outside the intended certificate storage location, potentially compromising system integrity or enabling further attacks. Additionally, the vulnerability permits deletion of files located outside the certificate root directory, creating opportunities for data destruction or system disruption. This represents a direct violation of the principle of least privilege and demonstrates a critical failure in access control enforcement within the application's file system operations.
The security implications of this vulnerability align with CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and can be categorized under ATT&CK technique T1059.007 (Command and Scripting Interpreter: Python) when attackers leverage the compromised certificate functionality for malicious file operations. The vulnerability's exploitation requires only authentication credentials with specific permissions, making it particularly dangerous in environments where certificate management operations are performed by multiple users or automated systems. The fix implemented in version 0.29.13 addresses this issue through proper input validation and path confinement mechanisms that ensure all certificate paths remain within the designated root directory boundaries.
Organizations deploying Dokploy should immediately upgrade to version 0.29.13 or later to remediate this vulnerability, as the attack surface remains active for any authenticated user with certificate management permissions. The vulnerability's impact is amplified by the fact that it operates at the file system level, potentially allowing attackers to compromise not just certificate data but also underlying system files or configuration resources. Security teams should conduct thorough audits of certificate-related operations and implement monitoring for unusual file system activity in certificate directories as additional defensive measures against potential exploitation attempts.