In Dokploy versions prior to 0.23.7 a medium severity vulnerability CVE-2025-53375 was detected. This vulnerability allows an authenticated attacker to read any file that the Traefik process user can access, including sensitive files such as /etc/passwd, application source code, and environment variable files containing credentials and secrets. This arbitrary file read flaw can potentially lead to the full compromise of other hosted services or facilitate lateral movement within the environment. To address this issue, users should upgrade Dokploy to version 0.23.7 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-53375.
In Dokploy versions up to and including 0.30.8 a medium severity vulnerability CVE-2026-111331 was detected. This vulnerability allows authenticated users with owner or admin roles in one organization to bypass authorization and manage ports belonging to other tenants. This occurs due to a cross-organization authorization bypass flaw within the port tRPC router. Because the target application’s organization is not explicitly verified, an attacker can supply a known portId or applicationId to endpoints such as port.create, port.one, port.update, or port.delete. This enables them to read, modify, delete, or add port mappings for unrelated organizations, effectively disrupting how victim services are published or maliciously routing traffic. To address this issue, users should upgrade Dokploy to a patched version 0.30.9 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-111331.