CVE-2025-53825
Critical
Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to version 0.24.3, an unauthenticated preview deployment vulnerability in Dokploy allows any user to execute arbitrary code and access sensitive environment variables by simply opening a pull request on a public repository. This exposes secrets and potentially enables remote code execution, putting all public Dokploy users using these preview deployments at risk. Version 0.24.3 contains a fix for the issue.
SeverityCritical
CVSS9.4
Exploit probability—
ProductDokploy
PublishedJul 14, 2025
First seenJul 14, 2025
Weakness typeCWE-862Missing authorization
How to fix
Update
- dokploy dokploy0.24.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dokploy dokploy | v < 0.24.3 | 0.24.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.