CVE-2026-72880

In Dokploy prior to 0.29.13, the apiCreateCertificate schema in schema/certificate.ts accepts a client-supplied certificatePath, and certificate.ts joins that value to the certificate root without confinement. An authenticated user with certificate create or delete permission can use certificatePath to write attacker-controlled certificate content outside the intended directory or delete an out-of-root directory. This vulnerability is fixed in 0.29.13.

An attacker can write or delete files outside the intended directory, potentially leading to system integrity compromise or denial of service.

Update Dokploy to version 0.29.13 or later to fix the vulnerability.