CVE-2026-82954

CVE-2026-82954 is a path traversal flaw (CWE-22) in Dokploy, an open-source self-hosted application deployment platform, affecting all versions up to and including 0.29.7. The issue is in the writeTraefikConfigInPath function of packages/server/src/utils/traefik/application.ts, part of the Settings component, where manipulation of the 'path' argument causes the application to write Traefik configuration files to attacker-influenced locations outside the intended directory; the attack is launched remotely and, per the CVSS 4.0 vector, requires only low privileges (an authenticated low-privileged user) and no user interaction. By writing files to arbitrary paths, an attacker can overwrite or tamper with sensitive files such as the Traefik dynamic configuration, potentially disrupting service routing or enabling further compromise of the host. Anyone running Dokploy 0.29.7 or earlier — typically administrators of self-hosted servers — is affected; the vendor was contacted early but did not respond, so there is no coordinated advisory or confirmed fixed release yet. A public exploit is reported to exist and may be used; current exploitation likelihood is modest (EPSS ~0.6% over 30 days) and the issue is not listed in CISA KEV.

What to do: Upgrade to the latest available Dokploy release (newer than 0.29.7) as soon as a patched build is published, since the vendor has not yet responded and no fixed version is confirmed. Until then, restrict access to the Dokploy panel to trusted networks only (VPN, firewall rules, or an authenticating reverse proxy) and check the Traefik configuration directory for unexpected or out-of-place file writes that could indicate exploitation. Monitor this disclosure for updates, as it is currently uncoordinated with the vendor.