Cyber & AI intelligence
Wasteland.
Briefs indexed2354
Issues26
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-82954 2026-08-31

Dokploy Path Traversal (CVE-2026-82954): Public Exploit, No Vendor Response

"A critical path traversal flaw in Dokploy 0.29.0 through 0.29.7 allows remote, low-privileged users to manipulate a file path argument in the Traefik configuration writer, with a public exploit already circulating and…"

A critical path traversal flaw in Dokploy 0.29.0 through 0.29.7 allows remote, low-privileged users to manipulate a file path argument in the Traefik configuration writer, with a public exploit already circulating and no vendor patch acknowledged.

What Is It

CVE-2026-82954 is a path traversal vulnerability (CWE-22) in Dokploy, disclosed by VulDB and published to NVD on August 31, 2026. The flaw lives in the writeTraefikConfigInPath function in packages/server/src/utils/traefik/application.ts, part of the Settings component. Manipulation of the path argument results in path traversal, and the attack can be launched remotely.

The CVSS v3.1 base score is 9.9 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, network attack vector, low complexity, only low privileges required, no user interaction, and a changed scope with high confidentiality, integrity, and availability impact. The CVSS v4.0 secondary score is 8.6 (HIGH) with exploit maturity rated PROOF_OF_CONCEPT.

Why It Matters

Per the NVD record, the exploit is now public and may be used. That moves this from theoretical to actionable for anyone running an exposed Dokploy instance.

Two aggravating factors: the changed-scope rating means impact extends beyond the vulnerable component itself, and the privilege bar is low rather than none, any authenticated user with minimal rights can reach it. Dokploy is a deployment platform, so if traversal via the path argument lets an attacker steer writes outside the intended configuration directory, that would be a serious foothold on the host running the Traefik config writer. The precise write primitive, which paths are reachable, and under what process permissions; is not detailed in the public disclosure, so the practical blast radius on a given deployment remains unconfirmed.

Notably, VulDB states the vendor was contacted early about this disclosure but did not respond in any way.

What's Vulnerable

Patch Status

No patch, fixed version, or vendor advisory has been published for this CVE, and the vendor did not respond to the disclosure. A check of the CISA Known Exploited Vulnerabilities catalog at time of writing returns no entry for CVE-2026-82954; meaning no federal confirmation of exploitation in the wild and no BOD 22-01 remediation deadline. That status can change; readers can verify current KEV listing directly at the catalog link below. NVD lists the record status as "Received," meaning analysis is not yet complete.

Sources