Unauthenticated Preview Deployment Vulnerability in Dokploy PaaS

CVE-2025-53825

What is CVE-2025-53825?

Dokploy, a self-hostable Platform as a Service (PaaS), has a vulnerability prior to version 0.24.3 that allows unauthorized users to execute arbitrary code. This vulnerability arises from an unauthenticated preview deployment issue, where malicious individuals can gain access to sensitive environment variables by merely opening a pull request on a public repository. As a result, all users employing public Dokploy instances with preview deployments are at significant risk, potentially exposing critical secrets and enabling remote code execution.

References