CVE-2026-72880

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13

Description Dokploy is a self-hostable Platform as a Service (PaaS). An authenticated user with permissions to create or delete certificates can exploit a path traversal issue. The apiCreateCertificate schema in packages/server/src/db/schema/certificate.ts accepts a client-supplied certificatePath variable, which is then joined to the certificate root in packages/server/src/services/certificate.ts without proper confinement. This allows an attacker to write controlled certificate content to locations outside the intended directory or delete directories outside the root.

Recommendations Update to version 0.29.13. Restrict the use of the certificatePath variable in the apiCreateCertificate schema until the update is applied.