Skip to content
Heist/ feed
Back to feed
Medium

Dokploy allows attackers to read any file that the Traefik process user can access

Type: advisorySources: OSV

Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated attacker can read any file that the Traefik process user can access (e.g., /etc/passwd, application source, environment variable files containing credentials and secrets). This may lead to full compromise of other services or lateral movement. This vulnerability is fixed in 0.23.7.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2025-53375
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 17:10 UTC · Revision 1

Source evidence

Dokploy allows attackers to read any file that the Traefik process user can access

core-osv · Original source

Published 7 Jul 2025, 16:02 UTC

Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated attacker can read any file that the Traefik process user can access (e.g., /etc/passwd, application source, environment variable files containing credentials and secrets). This may lead to full compromise of other services or lateral movement. This vulnerability is fixed in 0.23.7.

osv:CVE-2025-53375
Complete source record
{
  "id": "11f1f1477b19a6a45e901f1d8ebafab81585aff7e10d2633f7498cdd409bad62",
  "url": "https://osv.dev/vulnerability/CVE-2025-53375",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Dokploy allows attackers to read any file that the Traefik process user can access",
    "summary": "Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated attacker can read any file that the Traefik process user can access (e.g., /etc/passwd, application source, environment variable files containing credentials and secrets). This may lead to full compromise of other services or lateral movement. This vulnerability is fixed in 0.23.7.",
    "evidence": "osv:CVE-2025-53375",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2025-53375",
      "aliases": [
        "CVE-2025-53375",
        "GHSA-vq94-qm94-mxp6"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/dokploy/dokploy",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "5c73ced500dd4149a01a0a25a1026866cd800b23"
                },
                {
                  "fixed": "e42f6bc61050cd438726921fced64477cbf8f8e6"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:dokploy:dokploy:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.23.7"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "e42f6bc61050cd438726921fced64477cbf8f8e6"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v0.23.6",
            "v0.23.5",
            "v0.23.4",
            "v0.23.3",
            "v0.23.2",
            "v0.23.1",
            "v0.23.0",
            "v0.22.7",
            "v0.22.6",
            "v0.22.5",
            "v0.22.4",
            "v0.22.3",
            "v0.22.2",
            "v0.22.1",
            "v0.22.0",
            "v0.21.8",
            "v0.21.7",
            "v0.21.0",
            "v0.21.4",
            "v0.21.6",
            "v0.21.5",
            "v0.21.3",
            "v0.21.2",
            "v0.21.1",
            "v0.20.8",
            "v0.20.7",
            "v0.20.6",
            "v0.20.5",
            "v0.20.4",
            "v0.20.3",
            "v0.20.2",
            "v0.20.1",
            "v0.20.0",
            "v0.19.1",
            "v0.18.4",
            "v0.19.0",
            "v0.18.3",
            "v0.18.2",
            "v0.18.1",
            "v0.18.0",
            "v0.17.9",
            "v0.17.8",
            "v0.17.7",
            "v0.17.6",
            "v0.17.5",
            "v0.17.4",
            "v0.17.2",
            "v0.17.1",
            "v0.17.0",
            "v0.16.1",
            "v0.16.0",
            "v0.15.1",
            "v0.15.0",
            "v0.14.1",
            "v0.14.0",
            "v0.13.1",
            "v0.13.0",
            "v0.12.0",
            "v0.11.2",
            "v0.11.1",
            "v0.11.0",
            "v0.10.10",
            "v0.10.9",
            "v0.10.7",
            "v0.10.6",
            "v0.10.5",
            "v0.10.4",
            "v0.10.3",
            "v0.10.2",
            "v0.10.1",
            "v0.10.0",
            "v0.9.4",
            "v0.9.3",
            "v0.9.2",
            "v0.9.1",
            "v0.9.0",
            "v0.8.3",
            "v0.8.2",
            "v0.8.1",
            "v0.8.0",
            "v0.7.3",
            "v0.7.2",
            "v0.7.1",
            "v0.7.0",
            "v0.6.3",
            "v0.6.2",
            "v0.6.1",
            "v0.6.0",
            "v0.5.1",
            "v0.5.0",
            "v0.4.0",
            "v0.3.3",
            "v0.3.2",
            "v0.3.1",
            "v0.3.0",
            "v0.2.5",
            "v0.2.4",
            "v0.2.3",
            "v0.2.2",
            "v0.2.1",
            "v0.1.0",
            "v0.0.4",
            "v0.0.3",
            "v0.0.2",
            "v0.0.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53375.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:30.503933310Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53375.json",
        "https://github.com/Dokploy/dokploy/security/advisories/GHSA-vq94-qm94-mxp6",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-53375",
        "https://github.com/Dokploy/dokploy/commit/e42f6bc61050cd438726921fced64477cbf8f8e6"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-22"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53375.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-53375",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 497701,
  "published_at": "2025-07-07T16:02:03.797+00:00"
}