CVE-2025-53375CWE-22path-traversal

CVE-2025-53375

Medium · published July 7, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
36.2
In the wild
Unconfirmed
What it is

Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated attacker can read any file that the Traefik process user can access (e.g., /etc/passwd, application source, environment variable files containing credentials and secrets). This may lead to full compromise of other services or lateral movement. This vulnerability is fixed in 0.23.7.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00430 · 36.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-07-07T20:15Z
Affected products (1)
ProductVersionsFixed in
dokploy/dokploy< 0.23.70.23.7
References (2)
https://github.com/Dokploy/dokploy/commit/e42f6bc61050cd438726921fced64477cbf8f8e6 · [email protected]https://github.com/Dokploy/dokploy/security/advisories/GHSA-vq94-qm94-mxp6 · [email protected]
EPSS history
Timeline
  • 07 JUL 16:02Z
    Dokploy allows attackers to read any file that the Traefik process user can access
    cvelistv5