Dokploy writeTraefikConfigInPath Path Traversal RCE

Technical Analysis

The vulnerability resides in packages/server/src/utils/traefik/application.ts, where the writeTraefikConfigInPath function fails to sanitize the path argument before writing Traefik configuration data to disk, enabling classic directory traversal (e.g., '../' sequences) to escape the intended config directory. Since Traefik is used as a reverse proxy/router within Dokploy deployments, attacker-controlled writes to arbitrary filesystem locations can be leveraged to overwrite critical config files, inject malicious routing rules, or achieve code execution depending on file write targets and application privileges. The CVSS score of 9.9 reflects the remote, likely unauthenticated, low-complexity nature of the attack with high impact on confidentiality, integrity, and availability. Public exploit code increases the likelihood of mass scanning and exploitation attempts against internet-facing Dokploy instances. Many organizations use Dokploy to self-host and orchestrate containerized workloads, including AI agent backends, LLM inference services, and RAG pipeline components; a successful compromise could grant attackers control over the underlying host, exposing API keys, model weights, vector database credentials, and agent orchestration configurations, and could be used to pivot into connected agent tool-use infrastructure.

Affected Systems

Dokploy versions up to and including 0.29.7, specifically the Settings component and its Traefik configuration writer (packages/server/src/utils/traefik/application.ts); any self-hosted Dokploy deployment exposing the Settings/Traefik configuration endpoint to network access.

Indicators of Compromise

• No specific hashes, IPs, or domains published at this time; monitor for anomalous writes to Traefik configuration directories (e.g., unexpected .yml/.toml files outside standard paths)
• Suspicious HTTP requests to Dokploy Settings endpoints containing '../' or encoded traversal sequences (%2e%2e%2f) in path parameters
• Unexpected modifications to /etc/traefik or equivalent configured Traefik config paths

Remediation Steps

1. 1

   Isolate exposed instances

   Restrict network access to Dokploy management interfaces and Settings endpoints to trusted internal networks or VPN; do not expose administrative panels directly to the internet.

2. 2

   Apply input validation / WAF rules

   Deploy WAF or reverse proxy rules to block path traversal sequences (../, %2e%2e%2f) in requests to Dokploy Settings and Traefik configuration endpoints until an official patch is released.

3. 3

   Monitor for unauthorized file writes

   Implement file integrity monitoring on Traefik configuration directories and Dokploy application directories to detect unauthorized writes or modifications.

4. 4

   Upgrade when patch available

   Since the vendor has not responded, actively monitor the Dokploy GitHub repository and security advisories for an official fix; upgrade immediately once released.

5. 5

   Rotate credentials on compromised hosts

   If a Dokploy host also runs AI agent services, LLM API integrations, or RAG pipelines, rotate all API keys, service account credentials, and database secrets accessible from that host as a precaution.

6. 6

   Consider alternative deployment tooling

   Given the lack of vendor response, evaluate migrating critical or agent-supporting workloads to actively maintained PaaS/orchestration platforms until this issue is resolved.