{"metadata": {"vulnerability": "CVE-2026-128329", "count": 9, "kinds": {"milestone": 3, "sighting": 1, "kev": 0, "other": 5}, "linked_omitted": 0}, "data": [{"timestamp": "2026-11-12T08:16:46Z", "date_only": false, "value": "2026-11-12T08:16:46.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-128329", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-13T01:20:36.016Z", "date_only": false, "value": "2026-11-13T01:20:36.016Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-128329", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-13T09:33:44.203Z", "date_only": false, "value": "2026-11-13T09:33:44.203Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-128329", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-13T09:33:44.203Z", "date_only": false, "value": "2026-11-13T09:33:44.203Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-128329", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-13T09:33:44.203Z", "date_only": false, "value": "2026-11-13T09:33:44.203Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-128329", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-13T10:18:12Z", "date_only": false, "value": "2026-11-13T10:18:12Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-64H2-7CQR-4FM3", "record": "GHSA-64H2-7CQR-4FM3", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-13T10:27:16.742Z", "date_only": false, "value": "2026-11-13T10:27:16.742974Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117608653537076002", "record": "CVE-2026-128329", "field": "creation_timestamp", "uuid": "06c89080-f4d4-4d5a-88ee-2fd493d90a2f", "content": "CVE-2026-128329 Dokploy 0.28.0 before 0.31.1 Path Traversal via patch.readRepoFile Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to read arbitrary files by supplying ../ sequences in the filePath of patch.readRepoFile. Attackers with service read permission can read /etc/shadow, SSH private keys, and secret environment files on the Dokploy host or managed remote servers.\nhttps://www.cve.org/CVERecord?id=CVE-2026-128329https://github.com/Dokploy/dokploy/security/advisories/GHSA-g6rj-m32j-2mc4https://github.com/Dokploy/dokploy/commit/4b582856b36a0d037ff43ecbed2026d93f22ecc6https://github.com/Dokploy/dokploy/pull/5899https://github.com/Dokploy/dokploy/releases/tag/v0.31.1https://github.com/Dokploy/dokploy/commit/40e818b0e0d8e448e7a30c559ebf4e146e5932aehttps://github.com/Dokploy/dokploy/blob/v0.31.0/packages/server/src/services/patch-repo.ts#L148-L181https://www.vulncheck.com/advisories/dokploy-0.28.0-before-0.31.1-path-traversal-via-patch-readrepofile#Dokploy #dokploy#CVE_2026_128329#bot", "url": "https://infosec.exchange/users/cve/statuses/117608653537076002"}, {"timestamp": "2026-11-13T12:31:41Z", "date_only": false, "value": "2026-11-13T12:31:41Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-64H2-7CQR-4FM3", "record": "GHSA-64H2-7CQR-4FM3", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T12:31:41Z", "date_only": false, "value": "2026-11-13T12:31:41Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-64H2-7CQR-4FM3", "record": "GHSA-64H2-7CQR-4FM3", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-14T07:04:19.992Z", "anchors": {"origin": {"timestamp": "2026-11-12T08:16:46Z", "date_only": false, "value": "2026-11-12T08:16:46.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-128329", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-12T08:16:46Z", "date_only": false, "value": "2026-11-12T08:16:46.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-128329", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 168453.992748, "hours": 46.79277576333333, "days": 1.9496989901388888, "min_seconds": 168453.992748, "max_seconds": 168453.992748, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-12T08:16:46Z", "date_only": false, "value": "2026-11-12T08:16:46.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-128329", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-14T07:04:19.992Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}