CVE-2025-53375: Dokploy Information Disclosure Vulnerability

CVE-2025-53375 Overview

Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies deployment and management of applications and databases. CVE-2025-53375 is a path traversal vulnerability [CWE-22] in Dokploy's Traefik configuration reader endpoint. An authenticated attacker can read any file accessible to the Traefik process user, including /etc/passwd, application source code, and environment files containing credentials and secrets. The flaw stems from missing server ownership validation in the readConfigInPath tRPC procedure. Exploitation can expose secrets that enable lateral movement or full compromise of connected services. The issue is fixed in Dokploy version 0.23.7.

Critical Impact
Authenticated users can read arbitrary files on any Dokploy-managed server, exposing credentials and enabling lateral movement across hosted applications and databases.

Affected Products

Dokploy versions prior to 0.23.7
Self-hosted Dokploy PaaS deployments
Dokploy instances managing multi-tenant Traefik configurations

Discovery Timeline

2025-07-07 - CVE-2025-53375 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53375

Vulnerability Analysis

The vulnerability resides in the getConfigInPath tRPC procedure within apps/dokploy/server/api/routers/settings.ts. The handler calls readConfigInPath(input.path, input.serverId) using attacker-supplied values without verifying that the requesting user owns the targeted server. Any authenticated Dokploy user can supply an arbitrary path and a serverId belonging to another organization, causing the backend to read and return the file contents.

Because Traefik typically runs with elevated privileges to access configuration directories, the readable file surface includes /etc/passwd, Dokploy service files, compose definitions, .env files, and other secret stores. Harvested credentials can be reused to pivot into databases, container registries, and cloud APIs.

Root Cause

The root cause is missing authorization enforcement on the server identifier parameter. The code validated the authenticated session but did not confirm that input.serverId belongs to ctx.session.activeOrganizationId. Combined with the absence of path canonicalization and allow-listing, this permitted directory traversal through the exposed endpoint.

Attack Vector

An attacker with any valid Dokploy account issues a tRPC request to the settings router, supplying a target serverId from another tenant and an absolute file path. The server reads the file as the Traefik process user and returns the content in the API response. No user interaction is required.

typescript

// Patch excerpt: apps/dokploy/server/api/routers/settings.ts
					throw new TRPCError({ code: "UNAUTHORIZED" });
				}
			}

			if (input.serverId) {
				const server = await findServerById(input.serverId);

				if (server.organizationId !== ctx.session?.activeOrganizationId) {
					throw new TRPCError({ code: "UNAUTHORIZED" });
				}
			}

			return readConfigInPath(input.path, input.serverId);
		}),

The fix adds an explicit organization check before invoking readConfigInPath, throwing UNAUTHORIZED when the server does not belong to the active organization. Source: GitHub Commit e42f6bc.

Detection Methods for CVE-2025-53375

Indicators of Compromise

tRPC requests to the settings.getConfigInPath route with absolute paths such as /etc/passwd, /root/, or .env file references
Application logs showing readConfigInPath calls where serverId does not match the caller's organization
Unexpected outbound authentication attempts using credentials stored in Dokploy-managed .env files

Detection Strategies

Audit Dokploy API access logs for high-frequency getConfigInPath requests from a single session
Alert on any request whose path parameter resolves outside the expected Traefik configuration directory
Correlate access to the settings router with subsequent authentication events on managed databases or registries

Monitoring Recommendations

Enable verbose tRPC request logging on Dokploy, capturing authenticated user, serverId, and path parameters
Forward Dokploy and Traefik logs to a centralized analytics platform for cross-tenant anomaly detection
Monitor filesystem reads of sensitive files such as /etc/passwd and .env by the Traefik process

How to Mitigate CVE-2025-53375

Immediate Actions Required

Upgrade all Dokploy instances to version 0.23.7 or later without delay
Rotate any credentials, API keys, and secrets stored in Dokploy-managed environment files
Review audit logs for prior getConfigInPath requests referencing unexpected paths or cross-tenant serverId values
Restrict Dokploy account creation and review existing low-privilege accounts for suspicious activity

Patch Information

The fix is published in Dokploy 0.23.7 and corresponds to commit e42f6bc61050cd438726921fced64477cbf8f8e6. The patch adds organization-scoped validation of input.serverId in the settings router before invoking the file reader. See the GitHub Security Advisory GHSA-vq94-qm94-mxp6 for full details.

Workarounds

Place Dokploy behind a reverse proxy that restricts access to the settings router to trusted administrators only
Reduce the privileges of the Traefik process user to limit the file surface readable through the vulnerable endpoint
Isolate multi-tenant deployments into separate Dokploy instances until the patch is applied

bash

# Upgrade Dokploy to the patched release
docker pull dokploy/dokploy:0.23.7
docker service update --image dokploy/dokploy:0.23.7 dokploy

# Verify the running version
curl -s https://<dokploy-host>/api/version