Knowledge Base

In Dokploy versions prior to 0.23.7 a medium severity vulnerability CVE-2025-53375 was detected. This vulnerability allows an authenticated attacker to read any file that the Traefik process user can access, including sensitive files such as /etc/passwd, application source code, and environment variable files containing credentials and secrets. This arbitrary file read flaw can potentially lead to the full compromise of other hosted services or facilitate lateral movement within the environment. To address this issue, users should upgrade Dokploy to version 0.23.7 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-53375.

In Dokploy versions up to and including 0.30.8 a medium severity vulnerability CVE-2026-111331 was detected. This vulnerability allows authenticated users with owner or admin roles in one organization to bypass authorization and manage ports belonging to other tenants. This occurs due to a cross-organization authorization bypass flaw within the port tRPC router. Because the target application’s organization is not explicitly verified, an attacker can supply a known portId or applicationId to endpoints such as port.create, port.one, port.update, or port.delete. This enables them to read, modify, delete, or add port mappings for unrelated organizations, effectively disrupting how victim services are published or maliciously routing traffic. To address this issue, users should upgrade Dokploy to a patched version 0.30.9 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-111331.

In Discourse versions prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9 a high severity vulnerability CVE-2026-91159 was detected. This vulnerability allows an authenticated attacker to inject stored visual overlays or misleading user interfaces into post content, potentially leading to fraudulent interactions. This occurs due to a flaw in oEmbed processing, which improperly treats an entire attacker-controlled HTML fragment as trusted as long as it contains an iframe whose source matches the configured allowlist. By controlling a public webpage and its oEmbed response, an attacker with posting permissions can combine an allowlisted iframe with malicious sibling HTML or CSS. While this issue compromises content integrity, it does not expose restricted data or disrupt availability. To address this issue, users should upgrade Discourse to versions 2026.9.0, 2026.8.1, 2026.7.3, 2026.1.9, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-91159.

In Discourse versions prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9 a high severity vulnerability CVE-2026-91156 was detected. This vulnerability allows an authenticated user to receive live and recent chat messages from a read-restricted category, leading to unauthorized information disclosure. This occurs due to a flaw in the MessageBus audience calculation. The publication path bounded events solely by category visibility without enforcing the site’s group restrictions for Chat eligibility. Consequently, users who were permitted to view the category but explicitly denied access to Chat could still intercept live message content exposed in the MessageBus backlog. Note that this issue does not permit retrieval of the channel’s full history through the Chat API, nor does it allow message creation or modification. To address this issue, users should upgrade Discourse to versions 2026.9.0, 2026.8.1, 2026.7.3, 2026.1.9, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-91156.

In Directus versions prior to 11.13.0 a medium severity vulnerability CVE-2025-64746 was detected. This vulnerability can unintentionally grant roles unauthorized access to read or modify data. This occurs due to improper permission handling on deleted fields. When a field is removed from a collection, Directus fails to clean up its field-level permissions, leaving the reference in the permissions table intact. If an administrator later creates a new field using the exact same name, this new field automatically inherits the outdated, stale permission entries. This security gap is particularly risky in multi-tenant or production environments where field names might be reused under the assumption that old permissions were fully cleared. To address this issue, users should upgrade Directus to version 11.13.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-64746.

In Discourse versions prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9 a high severity vulnerability CVE-2026-91157 was detected. This vulnerability allows anonymous users to access restricted media and attachments, leading to unauthorized information disclosure. This occurs because sites with secure uploads enabled fail to reconcile existing upload security metadata when a previously public category becomes read-restricted, or when category permissions are modified during a bulk import. As a result, media and attachments uploaded while the category was public retain a public accessibility flag. These files remain reachable by anonymous users through their short upload URLs, even if the associated topics have been deleted. To address this issue, users should upgrade Discourse to versions 2026.9.0, 2026.8.1, 2026.7.3, 2026.1.9, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-91157.