CVE-2026-82954

Executive Summary

CVE-2026-82954 is a critical path traversal vulnerability (CWE-22) affecting Dokploy up to version 0.29.7. The flaw resides in the writeTraefikConfigInPath function within packages/server/src/utils/traefik/application.ts, part of the Settings component, where the path argument is improperly sanitized. An authenticated remote attacker can exploit this vulnerability to write arbitrary files to arbitrary locations on the host filesystem, potentially achieving remote code execution. The exploit is publicly disclosed, the vendor has not responded to disclosure efforts, and no patch is available; the CVSS score of 9.9 reflects the severity of unauthenticated-equivalent privilege escalation with full system compromise potential.

Technical Analysis

The vulnerability is a classic path traversal (directory traversal) flaw (CWE-22). The affected function, writeTraefikConfigInPath, is part of the Traefik configuration management subsystem in Dokploy. Dokploy is a self-hosted Platform-as-a-Service (PaaS) solution that automates deployment and reverse-proxy configuration for containerized applications. The Settings component exposes this function to users, presumably through an administrative or configuration interface.

Vulnerability Mechanism:

The writeTraefikConfigInPath function receives a path argument that is intended to specify where a Traefik configuration file should be written. The flaw is that this path is not validated against traversal sequences such as ../. An attacker who can supply a crafted path value containing directory traversal payloads (e.g., ../../../../etc/cron.d/evil) can cause the application to write file content to a location outside the intended directory.

The NVD description confirms:

• Attack Vector: Network (AV:N) — remotely exploitable over HTTP/HTTPS
• Privileges Required: Low (PR:L) — an authenticated user with access to the Settings component
• User Interaction: None (UI:N)
• Scope: Changed (S:C) — the impact crosses a trust boundary (the compromised component's authority extends beyond its sandbox)
• Confidentiality/Integrity/Availability Impact: High/High/High (C:H/I:H/A:H)

The key detail is that this is a file write primitive, not merely a file read. A write-what-where condition is substantially more critical than a typical path traversal read, as it enables content injection into sensitive system locations (crontabs, SSH authorized_keys, systemd units, web directories, etc.).

Code-Level Context:

The NVD description identifies:

• File: packages/server/src/utils/traefik/application.ts
• Function: writeTraefikConfigInPath
• Component: Settings

No additional code-level details are provided in the CVE data. The following code analysis is inferred from the vulnerability class and the file/function naming:

The function likely accepts user-controlled path input, constructs a filesystem path (e.g., path.join(traefikConfigDir, userSuppliedPath) or directly uses the supplied path), and writes Traefik configuration content to that path. The absence of canonicalization or traversal-sequence stripping (e.g., path.resolve() followed by prefix-check) permits escape from the intended directory.

No public PoC exploit code is available per the CVE data ("PoC/Exploit: None"), though the NVD states "The exploit is now public and may be used," indicating that the exploitation technique or a demonstration exists in the public domain, despite no formal PoC repository being tracked.

Exploitation Scenarios

The attack chain for CVE-2026-82954 is as follows, inferred strictly from the vulnerability class (path traversal leading to arbitrary file write):

Step 1: Reconnaissance / Target Identification

An attacker identifies Dokploy instances exposed to the internet or accessible within an enterprise network. Dokploy typically listens on ports 80/443 (web UI) and exposes an admin panel requiring authentication. Shodan queries such as title:"Dokploy" or product:"Dokploy" can identify exposed instances. The attacker enumerates the web application and attempts to authenticate with valid low-privileged credentials (or credentials obtained through other means — note PR:L).

Step 2: Triggering the Flaw

The attacker locates the Settings component within the authenticated admin panel. This component exposes the writeTraefikConfigInPath functionality, which writes Traefik configuration files (typically YAML or TOML). The attacker prepares a request to the Settings endpoint where the path parameter controls the filesystem destination. Rather than providing a legitimate path like traefik-configs/app1.yml, the attacker supplies a crafted path containing traversal sequences.

Step 3: Payload / Execution Method (Vulnerability-Class Level)

Because the exact HTTP API request format is not disclosed in the CVE data, the attack is described at the class level. The attacker supplies a path value such as:

• ../../../../etc/cron.d/persist — to write a cron job that executes a reverse shell or malware downloader.
• ../../../../root/.ssh/authorized_keys — to inject an attacker-controlled SSH public key, enabling direct root login.
• ../../../../etc/systemd/system/evil.service — to create a systemd unit that executes attacker code on boot.
• ../../../../var/www/html/shell.php — to plant a web shell in the web server's document root.

The file content written is the body of the Traefik configuration, which the attacker can also control (or at least partially control) through the Settings interface. Even if the content is somewhat structured, an attacker can craft valid Traefik configuration that, when placed in the right location, leads to code execution or persistent backdoor installation.

Step 4: Post-Exploitation Impact

Successful exploitation yields arbitrary file write as the user running the Dokploy server process (likely root or a service account with high privileges, given the administrative nature of the tool). Consequences include:

• Remote Code Execution: By writing to cron, systemd, or SSH, the attacker achieves code execution as the service user or root.
• Persistence: Backdoor files, scheduled tasks, or modified SSH keys ensure persistent access.
• Lateral Movement: Compromising the host provides a foothold into the application network.
• Full System Takeover: Given the high integrity/availability impact (I:H/A:H) and the typical elevated privileges of the Dokploy process, full host compromise is likely.

Note: No public PoC is available per the tracked data; the attack chain is inferred from the vulnerability class. The NVD states the exploit is "public," which suggests at least a public discussion or demonstration of the technique exists, though not formally archived as a PoC repository.

Impact Assessment

CVSS Analysis:

• Base Score: 9.9 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• Attack Vector (AV:N): Exploitable remotely over the network.
• Attack Complexity (AC:L): No special conditions; the attack is straightforward.
• Privileges Required (PR:L): Low-privileged account required. However, the scope change (S:C) mitigates the privilege requirement — the compromised component runs beyond its security boundary.
• Scope (S:C): The compromised component's impact extends to other resources (the underlying host OS).
• Confidentiality/Integrity/Availability (C:H/I:H/A:H): Complete loss of confidentiality, integrity, and availability of the underlying host.

Business Impact:

1. Unauthenticated-to-admin escalation route: Although PR:L is required, in many deployments default or weak credentials exist, or the attacker may leverage a separate low-severity vuln to obtain low privileges first. The 9.9 score indicates this is effectively equivalent to unauthenticated compromise in many real-world scenarios.
2. Data Loss / Ransomware: Arbitrary file write enables destructive payloads, including ransomware deployment across the host filesystem.
3. Supply Chain Risk: Dokploy manages containerized deployment pipelines; compromising the control plane allows an attacker to backdoor all images and applications deployed through the platform.
4. Full Infrastructure Compromise: Dokploy servers often have reachability to container registries, databases, and other internal services. A compromised host becomes a pivot point for lateral movement.

Affected Systems:

• All Dokploy deployments up to and including version 0.29.7.
• Self-hosted PaaS environments where Dokploy manages Docker containers and reverse-proxy (Traefik) configuration.
• Environments where the Settings component is exposed to authenticated (or partially authenticated) users.

Blast Radius:

• Direct host compromise → container compromise → internal network access → potential full-tenant data exposure in multi-tenant deployments.
• Given the scope change (S:C), the impact crosses the application boundary into the operating system and adjacent infrastructure.

Detection Guidance

Sigma Rule

title: Dokploy Path Traversal Write Attempt - CVE-2026-82954
id: 3b7c3b9a-4f5e-4c6d-9a1b-2c3d4e5f6a7b
status: experimental
description: Detects potential path traversal payloads in requests targeting Dokploy's Traefik configuration write functionality.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-82954
    - https://cwe.mitre.org/data/definitions/22.html
author: ValtersIT Threat Intelligence
date: 2026/01/01
logsource:
    category: webserver
    product: nginx  # adjust based on deployment proxy
    definition: 'Dokploy server logs'
detection:
    selection:
        c-uri|contains:
            - '/settings'
            - '/traefik'
        c-uri|contains:
            - 'path='
            - 'path:'
            - 'traefikConfigPath='
    traversal_patterns:
        c-uri|contains:
            - '..%2f'
            - '..%5c'
            - '../'
            - '..\\'
            - '%2e%2e%2f'
        c-uri|re: '((%2e%2e|\.\.)[/\\%])+'
    condition: selection and traversal_patterns
    filter:
        c-uri|startswith: '/static/'
fields:
    - clientip
    - c-uri
    - request_method
falsepositives:
    - Legitimate configuration paths if path sanitization is expected
level: critical

YARA Rule

rule dokploy_path_traversal_cve_2026_82954
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects path traversal payloads targeting Dokploy's writeTraefikConfigInPath / Settings functionality"
        date = "2026-01-01"
        cve = "CVE-2026-82954"
        severity = "critical"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-82954"
        hash = "not applicable"

    strings:
        $traversal1 = "..%2f"
        $traversal2 = "../"
        $traversal3 = "..\\"
        $traversal4 = "%2e%2e%2f"
        $traversal5 = "..%5c"
        $traversal6 = "/etc/"
        $traversal7 = "/root/"
        $traversal8 = "/var/www/"
        $traversal9 = "/tmp/"
        $traversal10 = "cron.d"
        $traversal11 = "authorized_keys"
        $traversal12 = "systemd"
        $traversal13 = ".ssh"
        $traversal14 = "writeTraefikConfigInPath"
        $path_param = "path="

    condition:
        uint16(0) == 0x0D0A and
        any of ($traversal*) and
        ($path_param or "traefik" in them)
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"ET EXPLOIT Dokploy writeTraefikConfigInPath Path Traversal Attempt (CVE-2026-82954)";
    flow:established,to_server;
    content:"POST"; http_method;
    content:"/settings"; http_uri;
    content:"path="; http_uri;
    content:".."; http_uri;
    pcre:"/(?:%2e%2e[\/\\%]|\.\.(?:\/|\\|%2f|%5c))/i";
    classtype:attempted-admin;
    sid:8295401;
    rev:1;
    metadata:created_at 2026_01_01, updated_at 2026_01_01, cve CVE-2026-82954;
)

Alternative rule for application/json body payloads:

alert http any any -> any any (
    msg:"ET EXPLOIT Dokploy Settings JSON Path Traversal Payload (CVE-2026-82954)";
    flow:established,to_server;
    content:"\"path\""; http_client_body;
    content:".."; http_client_body;
    pcre:"/\"path\"\s*:\s*\"[^\"]*\.\.(?:\/|\\|%2f)/i";
    classtype:attempted-admin;
    sid:8295402;
    rev:1;
)

Elastic Detection

// Elastic EQL — Detect path traversal in Dokploy Settings API calls
sequence by source.ip, user.name with maxspan=5m
  [network where event.category == "network" and protocol == "http" and
   http.request.uri contains "/settings" or http.request.uri contains "/traefik"]
  [process where event.category == "process" and
   (process.command_line contains ".." and
    (process.command_line contains "path" or process.command_line contains "traefik"))]

Alternative file-system event detection:

// Detect writes to sensitive system paths not normally written by Dokploy
file where event.action in ("write", "modify") and
  (file.path like "cron.d*" or
   file.path like "*authorized_keys*" or
   file.path like "*systemd/system/*.service" or
   file.path like "*/www/*" or
   file.path like "*traefik*" and file.path like "..*") and
  process.name == "node"  // Dokploy is a Node.js application

Splunk SPL Query

index=main sourcetype=nginx:access OR sourcetype=access_combined
| where like(uri, "%/settings%") AND (like(uri, "%..%2f%") OR like(uri, "%../%") OR like(uri, "%..\\%") OR like(uri, "%..%5c%") OR like(uri, "%2e%2e%2f%"))
| stats count by clientip, uri, method, status
| sort -count
| rename clientip as src_ip, uri as request_uri
| eval alert = "Possible Dokploy path traversal attempt (CVE-2026-82954)"
| table _time, src_ip, request_uri, method, status, count

Filesystem-level detection (Linux hosts):

index=ossec or index=syslog
| search "cron.d" OR "authorized_keys" OR (source="/var/log/audit/audit.log" AND "traefik")
| stats count by host, user, path, process
| eval alert = "Suspicious file write outside expected paths - Dokploy traversal"

Wazuh OSSEC Rule

<!-- Wazuh rule for CVE-2026-82954 monitoring -->
<group name="dokploy,">

  <!-- Detect path traversal in HTTP requests to Settings -->
  <rule id="100291" level="12">
    <if_sid>31100</if_sid>
    <match>/settings</match>
    <regex>\.\.(%2f|%5c|/|\\)</regex>
    <description>Possible Dokploy path traversal attempt (CVE-2026-82954) targeting Settings</description>
    <group>attack, exploitation, cve, CVE-2026-82954,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <!-- Detect writes to sensitive directories by node processes -->
  <rule id="100292" level="15">
    <if_sid>550</if_sid>
    <match>cron.d|authorized_keys|systemd|/var/www/</match>
    <field name="filesystem.file">\.</field>
    <description>Potential arbitrary file write via Dokploy path traversal (CVE-2026-82954) detected</description>
    <group>attack, persistence, exploitation, CVE-2026-82954,</group>
  </rule>

</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED. Patch confidence is 0/4 — no patch evidence from any tracked source. The vendor (Dokploy) was contacted during disclosure but did not respond. No fix version has been announced, and no workarounds have been officially documented.

Immediate Mitigations (compensating controls):

1. Network Restriction: Restrict access to the Dokploy web UI and API to trusted internal networks only. Place behind a VPN or bastion host. The Settings component should never be exposed to the public internet.
2. Authentication Hardening: Enforce strong passwords, MFA, and least-privilege accounts. Since PR:L is required, minimize the number of users with access to the Settings component.
3. Web Application Firewall (WAF): Deploy a WAF with rules to block path traversal payloads (e.g., character sequences like .., %2e%2e, %2f, %5c) in any request URI, headers, or body parameters referencing path.
4. Filesystem Controls: Run the Dokploy service as an unprivileged user (ideally not root). Use filesystem ACLs or SELinux/AppArmor policies to restrict the service user's write permissions to only the necessary directories (e.g., deny writes to /etc/cron.d, /root/.ssh, /etc/systemd/system, web roots).
5. Read-Only Filesystem for sensitive dirs: Mount critical system directories as read-only where feasible (e.g., /etc as read-only for the service user scope).

Patch / Upgrade Steps:

• None available. Monitor the Dokploy release channel (GitHub releases, official site) for a patched version > 0.29.7. If a newer version contains "path sanitization" or "path traversal fix" in changelogs, upgrade immediately.
• If upgrading is not possible, consider forking and patching the writeTraefikConfigInPath function to validate the path argument: canonicalize the path with path.resolve() and ensure the resolved path remains within the intended configuration directory. This requires source code modification and custom deployment.

Long-Term Hardening:

1. Vendor Responsiveness: If Dokploy is business-critical, establish a direct relationship with the vendor for security advisories. If the vendor remains unresponsive, consider a migration plan to alternative PaaS solutions with active security maintenance.
2. Code Review: Conduct a security code review of all file-handling functions in the Dokploy codebase, especially any that accept user input for filesystem paths.
3. Input Validation: Implement robust input validation — reject paths containing traversal sequences (.., %2e, %00 for null bytes), enforce allowlists of valid filenames, and use path.basename() when composing destination paths.
4. Least Privilege Principle: Never run Dokploy as root. Ensure containerized deployment of Dokploy itself (if possible) to sandbox filesystem access.
5. Monitoring: Implement continuous monitoring using the detection rules above to identify attempts and respond quickly.
6. Backup & Recovery: Maintain regular off-site backups to recover from any encryption or destructive payloads deployed via this vulnerability.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-82954
2. CWE-22 (Path Traversal): https://cwe.mitre.org/data/definitions/22.html
3. Dokploy Official Site: https://dokploy.com (check for security advisories and release notes)
4. Dokploy GitHub Repository: https://github.com/Dokploy/dokploy (monitor releases for patch)
5. CISA Known Exploited Vulnerabilities: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-82954 is NOT currently listed (KEV Status: NO).

Threat Actor Activity:

• Per the NVD description: "The exploit is now public and may be used." No specific threat actor campaign has been publicly attributed to this CVE as of the reporting date.
• EPSS has not yet scored this vulnerability (unscored by FIRST.org).
• No PoC repository, Nuclei template, or exploit code has been catalogued; however, public availability of the exploit technique increases the probability of imminent in-the-wild exploitation.
• Given the critical CVSS (9.9) and public exploit knowledge, expect exploitation attempts against exposed Dokploy instances within days to weeks of this disclosure. Immediate mitigation is strongly advised.