Vulnerability record · CVE-2025-53825 · published 14 July 2025

CVE-2025-53825: Dokploy missing authorization vulnerability

Dokploy · Dokploy

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to version 0.24.3, an unauthenticated preview deployment vulnerability in Dokploy allows any user to execute arbitrary code and access sensitive environment variables by simply opening a pull request on a public repository. This exposes secrets and potentially enables remote code execution, putting all public Dokploy users using these preview deployments at risk. Version 0.24.3 contains a fix for the issue.

9.8 CVSS 3.1 Critical EPSS 0.53% · top 57.6% CWE-862 · Missing authorization

9.8CVSS 3.1 base score

0.53%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

3References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Dokploy Dokploy

References

Link	Tags
https://github.com/Dokploy/dokploy/commit/1977235d313824b9764f1a06785fb7f73ab7eba2	Patch
https://github.com/Dokploy/dokploy/security/advisories/GHSA-h67g-mpq5-6ph5	Vendor Advisory
https://github.com/Dokploy/dokploy/security/advisories/GHSA-h67g-mpq5-6ph5	Vendor Advisory

Track CVE-2025-53825 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2026-24841Dokploy os command injection vulnerabilityDokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokp…EPSS 2.8%28 Jan 2026 8.8CVE-2026-24840Dokploy hard-coded credentials vulnerabilityDokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a hardcoded credential in the provided installation scrip…EPSS 0.37%28 Jan 2026 6.3CVE-2025-53376Dokploy os command injection vulnerabilityDokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated…EPSS 1.1%7 Jul 2025 6.1CVE-2026-24839Dokploy clickjacking vulnerabilityDokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, the Dokploy web interface is vulnerable to Clickjacking a…EPSS 0.24%28 Jan 2026 4.9CVE-2025-53375Dokploy path traversal vulnerabilityDokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated…EPSS 0.40%7 Jul 2025 1.3CVE-2025-53374Dokploy missing authorization vulnerabilityDokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated…EPSS 0.22%7 Jul 2025 9.9CVE-2026-84869ScreenConnect client allows unauthorized file transfer and execution in remote sessionsA flaw in the ConnectWise ScreenConnect client lets files be transferred and executed inside an active remote session without authorization or Host c…KEVEPSS 0.92%analysed8 Sep 2026 7.8CVE-2022-0492Linux kernel cgroups v1 release_agent privilege escalation and container escapeThe Linux kernel's cgroup_release_agent_write in kernel/cgroup/cgroup-v1.c mishandles authorization, letting the cgroups v1 release_agent feature be …KEVEPSS 5.5%analysed3 Mar 2022

Source: NIST National Vulnerability Database (record CVE-2025-53825), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.