Dokploy vulnerabilities

Dokploy from version 0.28.7 to 0.29.13 has a vulnerability in the server.remove tRPC mutation, which does not verify that the server's organization ID matches the session's active organization. An authenticated owner or administrator with server:delete in one organization can delete another organization's server and deployment records and receive the associated plaintext SSH private key.

In Dokploy version 0.19.0 and earlier, the protectedProcedure middleware only verifies user authentication but does not enforce organization scoping. Each endpoint must individually verify that the resource belongs to the user's organization. This affects multiple endpoints in various files.

In Dokploy version 0.29.0 and earlier, the deleteRegistry function executes docker logout without proper shell escaping of the registryUrl argument, allowing command injection. Unlike the docker login function which uses shEscape(), the lack of sanitization in deleteRegistry creates a vulnerability through a crafted registry URL.

Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated attacker can read any file that the Traefik process user can access (e.g., /etc/passwd, application source, environment variable files containing credentials and secrets). This may lead to full compromise of other services or lateral movement. This vulnerability is fixed in 0.23.7.