CVE-2026-82954: Dokploy Path Traversal Vulnerability

CVE-2026-82954 Overview

CVE-2026-82954 is a path traversal vulnerability in Dokploy through version 0.29.7. The flaw resides in the writeTraefikConfigInPath function within packages/server/src/utils/traefik/application.ts, which is part of the Settings component. Attackers manipulate the path argument to write Traefik configuration files outside the intended directory. The issue is remotely exploitable and requires only low privileges. Public exploit code exists, and the vendor did not respond to disclosure attempts. The weakness is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Authenticated remote attackers can write attacker-controlled Traefik configuration to arbitrary filesystem locations, enabling reverse proxy hijack, traffic interception, and potential code execution paths.

Affected Products

Dokploy versions up to and including 0.29.7
The vulnerable component is the Settings module handling Traefik configuration
Deployments exposing Dokploy management functions to networked users

Discovery Timeline

2026-08-31 - CVE-2026-82954 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-82954

Vulnerability Analysis

Dokploy is a self-hosted deployment platform that manages application routing through Traefik. The writeTraefikConfigInPath function in packages/server/src/utils/traefik/application.ts accepts a path parameter used to persist generated Traefik configuration YAML. The function does not canonicalize or validate the supplied path against an allowed base directory. Attackers with authenticated access supply crafted path values containing ../ sequences or absolute paths. The server then writes attacker-controlled configuration content to any location writable by the Dokploy process.

This vulnerability affects the integrity and confidentiality of both the Dokploy host and downstream systems routed by Traefik. Because Traefik reads dynamic configuration from disk, writing rogue routing rules redirects traffic, injects middlewares, or exposes internal services. Written files placed into cron paths, systemd unit directories, or web roots extend impact toward code execution.

Root Cause

The root cause is missing input validation on the path argument passed to writeTraefikConfigInPath. The function trusts a caller-supplied filesystem destination without enforcing a whitelist, canonical resolution, or containment check against the Traefik configuration base directory.

Attack Vector

An authenticated remote attacker submits a Settings request that reaches writeTraefikConfigInPath with a manipulated path parameter. The attacker supplies path traversal sequences to escape the intended directory. Because the exploit is public, opportunistic use against internet-exposed Dokploy instances is expected. See the VulDB entry for CVE-2026-82954 for additional technical detail.

Detection Methods for CVE-2026-82954

Indicators of Compromise

Unexpected files written outside the Traefik dynamic configuration directory, particularly YAML files created by the Dokploy service account
Traefik reload events referencing configuration paths that do not match the deployment's standard layout
HTTP requests to Dokploy Settings endpoints containing ../, URL-encoded %2e%2e%2f, or absolute filesystem paths in the path parameter
New or modified Traefik routers, services, or middlewares that were not created through normal deployment workflows

Detection Strategies

Enable filesystem auditing on the Dokploy host to log write operations by the Dokploy process outside of its expected working directories
Inspect Dokploy application logs for calls to writeTraefikConfigInPath with anomalous path values
Compare running Traefik dynamic configuration against a known-good baseline stored in version control
Correlate authenticated Dokploy user activity with configuration file changes to identify unauthorized modifications

Monitoring Recommendations

Alert on any file write by the Dokploy process to directories outside /etc/dokploy or the configured Traefik dynamic path
Monitor Traefik for sudden appearance of routes pointing to unexpected backends or exposing internal services
Log and review all Settings API requests, focusing on parameter values containing path separators or traversal sequences

How to Mitigate CVE-2026-82954

Immediate Actions Required

Restrict network access to the Dokploy management interface to trusted administrators via firewall rules or VPN
Rotate credentials for all Dokploy accounts and audit user list for unauthorized additions
Review the Traefik dynamic configuration directory and remove any files not created by legitimate deployment activity
Run the Dokploy process under a dedicated low-privilege user with write access limited to required directories only

Patch Information

No vendor patch has been published as of the CVE's last modification date. The vendor did not respond to disclosure attempts. Monitor the Dokploy GitHub repository for security updates and apply fixes as soon as they become available.

Workarounds

Deploy Dokploy behind an authenticating reverse proxy that restricts access to known administrator IP ranges
Enforce mandatory access controls, such as AppArmor or SELinux, to constrain the Dokploy process to its designated configuration directories
Mount the Traefik dynamic configuration directory with strict ownership so writes outside it fail at the filesystem layer
Disable or firewall Dokploy Settings endpoints if they are not required for current operations

bash

# Example AppArmor profile fragment restricting Dokploy writes
/etc/dokploy/** rw,
/etc/traefik/dynamic/** rw,
deny /** w,