CVE-2026-128328

MediumCVSS 5.0/10Last modified Nov 13, 2026

Description

Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to list tracked files of any git repository by supplying an arbitrary repoPath to patch.readRepoDirectories. Attackers with read access to one service can enumerate file and directory names of other tenants' application and compose source trees on the host or managed servers.

Metrics

CVSS 3.1 5.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Nov 13, 2026
Last modified: Nov 13, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1283297.7Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to read arbitrary files CVE-2026-1283304.2Miniflux before 2.3.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access because passw CVE-2026-1283315.3Miniflux before 2.3.5 contains an unverified password change vulnerability that allows holders of a signed-in session to change the account CVE-2026-1283327.4Listmonk 6.0.0 before 7.0.0-beta.2 contains a 2FA bypass vulnerability that allows attackers with a valid password to brute-force TOTP codes CVE-2026-1283337.4listmonk 6.0.0 before 7.0.0-beta.2 contains an authentication bypass vulnerability in doResetPassword that skips TOTP verification after a p CVE-2026-1283344.8listmonk 6.2.0 before 7.0.0-beta.2 contains a missing authentication vulnerability that allows unauthenticated attackers to submit Azure Eve CVE-2026-1283353.7Contao 4.6.0 before 5.3.54, 5.4.0-RC1 before 5.7.17, and 6.0.0-RC1 before 6.0.6 fails to invalidate existing user sessions when two-factor a CVE-2026-1283364.8ExcelJS through 4.4.0 contains a prototype pollution vulnerability that allows attackers to add numeric keys to Object.prototype through a c CVE-2026-1283377.0ExcelJS through 4.4.0 contains a prototype pollution vulnerability in mergeConditionalFormattings that allows attackers to modify Object.pro CVE-2026-1283387.5exceljs through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a worksheet col el CVE-2026-1283397.5ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet._parseMergeCells that allows attackers to crash applications b CVE-2026-1283407.5ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an