Originally published at HOL

CVE-2026-72880: Dokploy Certificate Path Traversal Enables Arbitrary File Write and Remote Code Execution

TL;DR: Dokploy versions prior to 0.29.13 accept a user-supplied certificatePath without confining it to the certificate root directory. An authenticated user with certificate permissions can write files anywhere on the host filesystem or execute arbitrary OS commands. Upgrade to 0.29.13 to fix this.

What to do

Update Dokploy to version 0.29.13. The fix was released as part of a coordinated disclosure of eight Dokploy vulnerabilities patched in the same release. If you run Dokploy on a Docker container, pull the latest image and recreate the container:

docker pull dokploy/dokploy:0.29.13
docker compose down && docker compose up -d

If you installed Dokploy via the install script, run the upgrade command:

dokploy upgrade

Audit your certificate store after upgrading. Check for certificates created with unusual paths that point outside the standard certificate directory. Delete any suspicious entries. Review your Dokploy audit logs for certificate creation events from non-admin users.

Restrict who can create and delete certificates in your Dokploy instance. The vulnerability requires an authenticated user with certificate permissions. If your team has members who only need application deployment access, do not grant them certificate management roles.

What happened

The vulnerability sits in Dokploy's certificate management subsystem. The apiCreateCertificate schema in packages/server/src/db/schema/certificate.ts accepts a certificatePath field from the client. The certificate service in packages/server/src/services/certificate.ts takes that value and joins it to the certificate root directory using a path join operation with no confinement check.

Because certificatePath is not sanitized or constrained to the certificate root, an attacker can supply a traversal sequence like ../../../etc/cron.d/malicious to write attacker-controlled certificate content to arbitrary locations on the host. The file write is not restricted to certificate files. Any content supplied by the user gets written to the target path.

The delete operation has the same flaw. A user with certificate delete permission can supply a traversal path pointing to any directory on the host and delete it.

The path traversal alone is serious. The real-world impact compounds because Dokploy runs Docker commands on the host. Writing a file to a location like /etc/cron.d/ or a writable system directory gives the attacker code execution on the host operating system. The certificate content itself becomes the payload.

Who is affected

Dokploy is an open-source, self-hostable Platform as a Service built on Docker and Docker Swarm. You deploy it on your own server and use it to manage applications, databases, and services the way you would with Heroku or Vercel, but on infrastructure you control. The project has over 18,000 stars on GitHub and an active community of self-hosters and small teams running production workloads on it.

All Dokploy versions prior to 0.29.13 are affected. The vulnerability requires authentication, but any user with certificate create or delete permissions can exploit it. In many Dokploy deployments, non-admin team members have broader permissions than necessary. The attack surface widens if the instance is exposed to the internet without IP restrictions.

Eight related CVEs were fixed in the same 0.29.13 release: command injection via database credentials in backup/restore (CVE-2026-72881), blind command injection through file mounts (CVE-2026-72882), WebSocket terminal missing access control (CVE-2026-72883), compose custom command injection (CVE-2026-72884), Dockerfile builder context injection (CVE-2026-72885), incomplete fix of a prior scheduling privilege escalation (CVE-2026-72886), cross-organization IDOR leading to root RCE (CVE-2026-72876), and unescaped Git URL injection (CVE-2026-72874). The release is a security-focused batch fix.

Why it matters

Path traversal in a PaaS control plane is particularly dangerous because the platform manages server-level operations. A file write outside the certificate directory is not a boundary. It is a stepping stone to host-level code execution. On a Dokploy host running multiple applications and databases, one compromised certificate path can pivot to full server takeover.

This CVE was published on August 10, 2026. NVD has not assigned a CVSS score. No EPSS data is available. The vulnerability is not in CISA's Known Exploited Vulnerabilities catalog. The practical severity depends on your Dokploy exposure. Instances reachable from the internet with multiple authenticated users face the highest risk.

References

• CVE-2026-72880 on hol.org
• NVD entry: pending (CVE submitted to CVE List V5 on August 10, 2026)
• Related Dokploy CVEs fixed in 0.29.13: CVE-2026-72874, CVE-2026-72876, CVE-2026-72881, CVE-2026-72882, CVE-2026-72883, CVE-2026-72884, CVE-2026-72885, CVE-2026-72886