CVE-2026-128328

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-128328", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-13T01:20:35.660Z", "datePublished": "2026-11-13T09:33:44.878Z", "dateUpdated": "2026-11-13T09:33:44.878Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-13T09:33:44.878Z"}, "datePublic": "2026-11-12T08:14:53.000Z", "title": "Dokploy 0.28.0 before 0.31.1 Path Traversal via patch.readRepoDirectories repoPath", "descriptions": [{"lang": "en", "value": "Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to list tracked files of any git repository by supplying an arbitrary repoPath to patch.readRepoDirectories. Attackers with read access to one service can enumerate file and directory names of other tenants' application and compose source trees on the host or managed servers."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "cweId": "CWE-22", "type": "CWE"}]}], "affected": [{"vendor": "Dokploy", "product": "dokploy", "defaultStatus": "unaffected", "versions": [{"version": "0.28.0", "status": "affected", "versionType": "semver", "lessThan": "0.31.1"}], "packageURL": "pkg:github/Dokploy/dokploy"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:dokploy:dokploy:*:*:*:*:*:*:*:*", "versionStartIncluding": "0.28.0", "versionEndExcluding": "0.31.1"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 5, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-q7cq-vxv7-449c", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-q7cq-vxv7-449c)"}, {"url": "https://github.com/Dokploy/dokploy/commit/4b582856b36a0d037ff43ecbed2026d93f22ecc6", "tags": ["patch"]}, {"url": "https://github.com/Dokploy/dokploy/pull/5899", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/Dokploy/dokploy/releases/tag/v0.31.1", "tags": ["release-notes"], "name": "dokploy v0.31.1 Release Notes"}, {"url": "https://github.com/Dokploy/dokploy/blob/v0.31.0/apps/dokploy/server/api/routers/patch.ts#L181-L202", "tags": ["technical-description"]}, {"url": "https://github.com/Dokploy/dokploy/blob/v0.31.0/packages/server/src/services/patch-repo.ts#L84-L90", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: Dokploy 0.28.0 before 0.31.1 Path Traversal via patch.readRepoDirectories repoPath", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/dokploy-0.28.0-before-0.31.1-path-traversal-via-patch-readrepodirectories-repopath"}], "credits": [{"lang": "en", "value": "Sandipkumar sah", "type": "finder"}, {"lang": "en", "value": "Mauricio Siu", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/Dokploy/dokploy", "product": "dokploy", "vendor": "Dokploy", "versions": [{"lessThan": "0.31.1", "status": "affected", "version": "0.28.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to list tracked files of any git repository by supplying an arbitrary repoPath to patch.readRepoDirectories. Attackers with read access to one service can enumerate file and directory names of other tenants' application and compose source trees on the host or managed servers."}], "id": "CVE-2026-128328", "lastModified": "2026-11-13T10:18:12.473", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-11-13T10:18:12.340", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/Dokploy/dokploy/blob/v0.31.0/apps/dokploy/server/api/routers/patch.ts#L181-L202"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/Dokploy/dokploy/blob/v0.31.0/packages/server/src/services/patch-repo.ts#L84-L90"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/Dokploy/dokploy/commit/4b582856b36a0d037ff43ecbed2026d93f22ecc6"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/Dokploy/dokploy/pull/5899"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/Dokploy/dokploy/releases/tag/v0.31.1"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-q7cq-vxv7-449c"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/dokploy-0.28.0-before-0.31.1-path-traversal-via-patch-readrepodirectories-repopath"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{}

{}