A critical path traversal flaw in Dokploy permits authenticated users to write any file to the host filesystem during application deployment. The vulnerability is described by CWE‑22 and CWE‑35 and enables attackers to create or modify system files, inject malicious cron jobs, and ultimately gain full control of the target server. This flaw bypasses container isolation for remote server deployments, allowing direct tampering with remote filesystems and installation of persistent backdoors.

Affected systems are Dokploy installations running version 0.26.5 or earlier. The platform is a self‑hosted, free Platform as a Service that supports both local and remote deployment of applications; any user with deployment privileges can trigger the vulnerability.

The CVSS score of 9.9 marks this flaw as critical, and although no EPSS value is available, the potential for widespread exploitation remains high due to the necessity of only an authenticated deployment account. The vulnerability has not yet appeared in the CISA KEV catalog, but its impact suggests it would be considered high‑risk if widely deployed. Attackers could exploit the flaw by authenticating to the application, then deploying an application that writes a malicious script to a location that is executed as a cron job, effectively achieving remote code execution and full server compromise.