Gabriel Alves

**Name of the Vulnerable Software and Affected Versions** Dokploy versions prior to 0.29.8 **Description** An unauthenticated path traversal issue exists in the Settings component. The `writeTraefikConfigInPath()` function within the `packages/server/src/utils/traefik/application.ts` file fails to properly handle the `path` argument, allowing a remote attacker to write arbitrary files. This can lead to Remote Code Execution (RCE), which is the ability to execute malicious commands on the target machine, and a full compromise of the CI/CD pipeline. **Recommendations** Update to version 0.29.8 or later. As a temporary mitigation, restrict access to the Settings component and the `writeTraefikConfigInPath()` function.

**Name of the Vulnerable Software and Affected Versions** hyperledger-firefly versions prior to 1.4.1 **Description** A server-side request forgery (SSRF) exists within the Webhook Subscription component. This occurs when the `url` argument is manipulated in the `ValidateOptions()` function located in the `internal/events/webhooks/webhooks.go` file, allowing for remote exploitation. **Recommendations** As a temporary workaround, restrict the use of the `url` argument in the `ValidateOptions()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.