CVE-2025-53825 Dokploy's Preview Deployments are vulnerable to Remote Code Execution

What is CVE-2025-53825?

CVE-2025-53825 is a critical missing authorization vulnerability in dokploy, published on 14 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to version 0.24.3, an unauthenticated preview deployment vulnerability in Dokploy allows any user to execute arbitrary code and access sensitive environment variables by simply opening a pull request on a public repository. This exposes secrets and potentially enables remote code execution, putting all public Dokploy users using these preview deployments at risk. Version 0.24.3 contains a fix for the issue.

Weakness: CWE-862

Which versions are affected by CVE-2025-53825?

It affects 1 product.

Products include Dokploy Dokploy.

How do I fix CVE-2025-53825?

No fix has been published for CVE-2025-53825 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-53825 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-53825 exists.

Other vulnerabilities in dokploy

• CVE-2026-24841 Command injection in dokploy Critical 9.9
• CVE-2026-24840 Dokploy uses hardcoded credentials in installation script, which could result in database access High 8.0
• CVE-2025-53376 Dokploy allows attackers to run arbitrary OS commands on the Dokploy host. Medium 6.3
• CVE-2025-53375 Dokploy allows attackers to read any file that the Traefik process user can access Medium 4.9
• CVE-2026-24839 Dokploy has a clickjacking vulnerability - Missing X-Frame-Options and CSP frame-ancestors headers Medium 4.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h67g-mpq5-6ph5.