CyberRota Analysis
AI-GeneratedDokploy versions prior to 0.29.13 are vulnerable to a critical issue where authenticated users with certificate creation or deletion permissions can manipulate the `certificatePath` parameter to write malicious certificate content or delete files outside the intended directory. This could lead to unauthorized access or disruption of services. Organizations using Dokploy should prioritize upgrading to version 0.29.13 or later to mitigate this severe risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the apiCreateCertificate schema in packages/server/src/db/schema/certificate.ts accepts a client-supplied certificatePath, and packages/server/src/services/certificate.ts joins that value to the certificate root without confinement. An authenticated user with certificate create or delete permission can use certificatePath to write attacker-controlled certificate content outside the intended directory or delete an out-of-root directory. This vulnerability is fixed in 0.29.13.