CVE-2026-82954

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.8

Description An unauthenticated path traversal issue exists in the Settings component. The writeTraefikConfigInPath() function within the packages/server/src/utils/traefik/application.ts file fails to properly handle the path argument, allowing a remote attacker to write arbitrary files. This can lead to Remote Code Execution (RCE), which is the ability to execute malicious commands on the target machine, and a full compromise of the CI/CD pipeline.

Recommendations Update to version 0.29.8 or later. As a temporary mitigation, restrict access to the Settings component and the writeTraefikConfigInPath() function.