---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy versions before 0.29.13 are vulnerable to OS command injection via the registry testing functions, allowing authenticated users to execute arbitrary commands on the host or remote server.

Executive Summary:
An authenticated OS command injection vulnerability in Dokploy versions prior to 0.29.13 allows attackers to execute arbitrary code on target servers, posing a critical risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-72902

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: This vulnerability is an OS command injection flaw (CWE-78) occurring because the application improperly interpolates user-controlled password fields into shell commands. Exploitation requires the attacker to have an authenticated session.

Business Impact

Successful exploitation grants an attacker the ability to execute arbitrary commands with the privileges of the Dokploy service. Given the CVSS score of 9.9, this vulnerability could lead to total system compromise, unauthorized data access, and the potential for lateral movement within the infrastructure.

Remediation Plan

Immediate Action: Upgrade the Dokploy instance to version 0.29.13 or later immediately.

Proactive Monitoring: Monitor server logs for suspicious shell commands or anomalous process execution originating from the Dokploy service account.

Compensating Controls: Ensure the Dokploy service runs with the least privilege necessary, and utilize network segmentation to limit the impact if the host is compromised.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of Aug 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous as it bridges the gap between application logic and system-level command execution.

Analyst Recommendation

The critical severity of this vulnerability necessitates immediate patching. Organizations should prioritize updating to version 0.29.13 to prevent potential remote code execution and maintain the security posture of their deployment environments.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: >= 0.29.2, < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper privilege management vulnerability in Dokploy allows authenticated users to escalate privileges and execute arbitrary scripts as root on the host machine.

Executive Summary:
A critical authorization bypass in Dokploy enables authenticated users to escalate privileges and execute commands as root, leading to full host compromise.

Vulnerability Details

CVE-ID: CVE-2026-72886

Affected Software: Dokploy dokploy

Affected Versions: >= 0.29.2, < 0.29.13

Vulnerability: The flaw exists within the schedule management API, where improper authorization checks allow an authenticated member to attach their application to a schedule and run scripts as root. This bypasses intended access controls for non-administrative users.

Business Impact

An attacker with minimal access can leverage this flaw to gain root-level control over the underlying server. This total compromise could result in the theft of sensitive data, modification of application environments, or persistent access to the infrastructure. The 9.9 CVSS score reflects the high impact of a root-level privilege escalation.

Remediation Plan

Immediate Action: Update Dokploy to version 0.29.13 or later immediately to resolve the authorization logic flaw.

Proactive Monitoring: Review audit logs for suspicious activity related to the schedule API and monitor for unexpected process execution with root privileges.

Compensating Controls: Implement strict access control lists for users within the Dokploy environment and limit user roles to the minimum necessary for their function.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of Aug 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable once a user has authenticated, making internal threats a significant concern.

Analyst Recommendation

This vulnerability presents a severe risk due to the potential for root escalation. Organizations using Dokploy should perform an immediate update to version 0.29.13 and audit their user permissions to ensure no unauthorized activities have already occurred.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy contains an OS command injection vulnerability, allowing authenticated users with low privileges to execute arbitrary commands on the underlying host.

Executive Summary:
An OS command injection vulnerability in Dokploy allows authenticated attackers to gain unauthorized command execution on the host system.

Vulnerability Details

CVE-ID: CVE-2026-72884

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: This vulnerability involves the improper neutralization of special elements used in an OS command (CWE-78). It requires the attacker to have low-level privileges to successfully inject and execute arbitrary commands.

Business Impact

Successful exploitation leads to full system compromise, as the attacker can execute arbitrary commands with the privileges of the Dokploy service. With a CVSS score of 8.7, this represents a significant risk of data exfiltration, service manipulation, and lateral movement within the environment.

Remediation Plan

Immediate Action: Update Dokploy to version 0.29.13 or later to apply the necessary security fixes.

Proactive Monitoring: Review audit logs for suspicious process execution or unexpected shell activity initiated by the Dokploy user account.

Compensating Controls: Ensure the Dokploy process runs with the least privilege necessary and utilize containerization or sandboxing to limit the scope of potential command execution.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Command injection remains a high-risk vector that should be remediated by updating the software immediately.

Analyst Recommendation

The severity of this command injection flaw necessitates an immediate update to version 0.29.13. Security teams should prioritize patching this instance to prevent potential full-system compromise.

---METADATA---
VENDOR: Dokploy
PRODUCT: Dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy is affected by a missing authorization vulnerability, which allows authenticated users to perform unauthorized actions within the platform.

Executive Summary:
A missing authorization vulnerability in Dokploy permits authenticated users to execute unauthorized operations, posing a high risk to the security of hosted applications.

Vulnerability Details

CVE-ID: CVE-2026-72883

Affected Software: Dokploy Dokploy

Affected Versions: < 0.29.13

Vulnerability: The software fails to properly enforce authorization checks, allowing an authenticated user to perform actions outside of their intended permissions scope.

Business Impact

With a CVSS score of 8.8, this flaw could allow an attacker to gain excessive privileges, potentially leading to unauthorized modification or deletion of deployments, data, and system configurations. This threatens the integrity of all services managed through the Dokploy platform.

Remediation Plan

Immediate Action: Update the Dokploy installation to version 0.29.13 or later immediately to resolve the authorization logic error.

Proactive Monitoring: Review application logs for unauthorized access attempts or suspicious configuration changes performed by lower-privileged user accounts.

Compensating Controls: Audit user permissions within the Dokploy dashboard to ensure that the principle of least privilege is strictly maintained.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The fix is readily available in the referenced commit history and release notes, making remediation straightforward for administrators.

Analyst Recommendation

Maintaining proper authorization is fundamental to the security of a platform as a service. It is highly recommended that all users upgrade to version 0.29.13 immediately to eliminate the risk of privilege escalation and unauthorized system management.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: <= 0.28.8
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Dokploy versions 0.28.8 and earlier are vulnerable to OS command injection via the filePath parameter, allowing authenticated users to execute arbitrary commands on remote servers.

Executive Summary:
An authenticated OS command injection vulnerability in Dokploy allows attackers to execute arbitrary code on remote managed servers, leading to remote host compromise.

Vulnerability Details

CVE-ID: CVE-2026-72882

Affected Software: Dokploy dokploy

Affected Versions: <= 0.28.8

Vulnerability: The application fails to properly sanitize the filePath parameter when configuring file mounts for services. An authenticated user can inject malicious shell metacharacters, resulting in OS command injection that executes with the privileges of the Dokploy service on the target host.

Business Impact

The ability to execute commands on remote managed servers via the web interface provides an attacker with a direct path to host-level exploitation. With a CVSS score of 9.9, this vulnerability severely undermines the security of the entire infrastructure managed by Dokploy. Unauthorized command execution can lead to complete system takeover and the compromise of all hosted data.

Remediation Plan

Immediate Action: Verify if a vendor-supplied patch is available for your specific deployment and apply it immediately; if no patch is currently available, restrict access to the file mount configuration interface.

Proactive Monitoring: Review SSH logs on managed servers for suspicious command execution patterns or unexpected connections from the Dokploy host.

Compensating Controls: Utilize a Web Application Firewall to block requests containing shell metacharacters in the filePath input field.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly critical due to the ease of achieving remote code execution.

Analyst Recommendation

This vulnerability is a high-risk entry point for remote code execution. Administrators should audit all service file mount configurations and restrict access to these settings until a verified patch can be applied.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy versions before 0.29.13 contain an arbitrary file write and deletion vulnerability due to improper input validation in the certificate management service.

Executive Summary:
A critical directory traversal vulnerability in Dokploy allows authenticated users with specific permissions to perform unauthorized file operations on the host system.

Vulnerability Details

CVE-ID: CVE-2026-72880

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: The application fails to properly sanitize the certificatePath parameter, which allows an authenticated user with certificate management permissions to escape the intended directory and execute arbitrary file writes or deletions.

Business Impact

Successful exploitation of this flaw allows a malicious actor to overwrite critical system files or delete essential data, potentially leading to a complete compromise of the host server. Given the CVSS score of 9.9, this vulnerability represents an extreme risk to system integrity and availability, as it permits unauthorized administrative-level actions within the application environment.

Remediation Plan

Immediate Action: Update Dokploy to version 0.29.13 or later immediately to apply the necessary path validation fixes.

Proactive Monitoring: Review audit logs for unusual file access patterns or unexpected attempts to modify files outside of the standard application directories.

Compensating Controls: Restrict access to the certificate management interface to the absolute minimum number of trusted users and employ file integrity monitoring on the host to detect unauthorized changes.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it allows direct filesystem manipulation by an authenticated user.

Analyst Recommendation

This vulnerability presents a severe risk to the host environment due to the potential for arbitrary file manipulation. Organizations should prioritize patching to version 0.29.13 immediately to mitigate the risk of host compromise.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy versions prior to 0.29.8 are vulnerable to OS command injection via the getRegistryCommands function, allowing authenticated users to execute arbitrary commands on the host server.

Executive Summary:
An authenticated command injection vulnerability in Dokploy allows a user with project access to gain full control over the underlying host operating system.

Vulnerability Details

CVE-ID: CVE-2026-72879

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.8

Vulnerability: The application fails to properly sanitize input within the getRegistryCommands function, which interpolates registry credentials directly into a shell command. An authenticated attacker can leverage this by providing malicious credentials to trigger arbitrary command execution on the host server.

Business Impact

This vulnerability carries a CVSS score of 9.4, reflecting its critical severity. Successful exploitation allows an attacker to gain unauthorized access to the server, modify host files, and potentially compromise other containers managed by the platform. This leads to a total loss of confidentiality, integrity, and availability for the affected infrastructure.

Remediation Plan

Immediate Action: Update Dokploy to version 0.29.8 or later immediately to apply the necessary input sanitization fixes.

Proactive Monitoring: Review system logs for suspicious shell activity or unexpected processes initiated by the Dokploy service user.

Compensating Controls: Restrict access to the platform to trusted users only, and employ network segmentation to limit the potential blast radius of a compromised container host.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable due to the lack of input sanitization in a function that interacts directly with the system shell.

Analyst Recommendation

Given the critical severity of this OS command injection vulnerability, administrators should prioritize patching their Dokploy instances. Applying version 0.29.8 or higher is essential to prevent unauthorized system access and potential full host compromise.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy prior to 0.29.13 is vulnerable to OS command injection via the backup and restore pipeline, allowing authenticated admins to execute arbitrary commands on the host machine.

Executive Summary:
This critical OS command injection vulnerability in Dokploy allows an authenticated administrator to execute arbitrary commands on the host server, leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-72878

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: The vulnerability exists in the backup and restore pipeline, where user-controlled database fields are improperly sanitized before being passed to system shell execution functions, allowing for command injection by an authenticated user with administrative privileges.

Business Impact

With a CVSS score of 9.6, this vulnerability poses a severe threat to infrastructure. Because the commands execute on the host machine rather than within a container, an attacker can escape the application environment to gain full control of the underlying host operating system, resulting in total loss of confidentiality and integrity.

Remediation Plan

Immediate Action: Upgrade Dokploy to version 0.29.13 or later to implement secure command handling and input sanitization.

Proactive Monitoring: Audit logs for suspicious shell process execution or unexpected child processes spawning from the Dokploy service.

Compensating Controls: Ensure that the Dokploy service is running with the least privilege necessary, and consider implementing host-based intrusion detection systems to alert on unauthorized command execution.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires authentication, the ability to escape container isolation makes this a high-priority risk for all users.

Analyst Recommendation

Administrators should treat this as a high-urgency update. Patching the application to version 0.29.13 is the only effective way to remediate the unsafe command interpolation within the backup and restore pipeline.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy versions before 0.29.13 contain an authorization bypass and OS command injection flaw, allowing authenticated users to manipulate server IDs and execute commands on other tenants' servers.

Executive Summary:
A critical authorization bypass and command injection vulnerability in Dokploy versions prior to 0.29.13 enables cross-tenant command execution and total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-72876

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: This flaw involves an authorization bypass (CWE-639, CWE-862) combined with OS command injection (CWE-78), where the application fails to validate organization ownership before performing operations on server resources. An authenticated user with read-only permissions can trigger command execution on servers belonging to other tenants.

Business Impact

This vulnerability represents a catastrophic failure of multi-tenancy isolation. With a CVSS score of 9.9, an attacker can pivot between environments, execute arbitrary code on remote servers, and access data across the entire platform, leading to severe reputational and operational damage.

Remediation Plan

Immediate Action: Upgrade to Dokploy version 0.29.13 or later to enforce proper authorization checks and sanitize command inputs.

Proactive Monitoring: Review audit logs for unauthorized access attempts to server IDs or unexpected cross-tenant activity.

Compensating Controls: Implement strict network-level isolation between different customer environments if immediate patching is delayed.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of Aug 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The combination of authorization bypass and command injection makes this a high-value target for attackers.

Analyst Recommendation

Given the availability of a proof-of-concept and the critical nature of the vulnerability, patching must be treated as an emergency task. Administrators should verify the update to version 0.29.13 is applied across all instances to prevent unauthorized cross-tenant access.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy versions prior to 0.29.13 are vulnerable to OS command injection, which can be exploited by an authenticated user to achieve arbitrary command execution.

Executive Summary:
An OS command injection vulnerability in Dokploy permits authenticated users to execute arbitrary commands, posing a high risk to the security and availability of the PaaS environment.

Vulnerability Details

CVE-ID: CVE-2026-72875

Affected Software: Dokploy

Affected Versions: < 0.29.13

Vulnerability: This vulnerability occurs due to improper neutralization of special elements within OS commands. It allows an authenticated user to inject malicious instructions that are then executed by the underlying operating system.

Business Impact

Exploitation of this flaw allows an attacker to bypass security boundaries, potentially leading to unauthorized access to the underlying infrastructure hosting the Platform as a Service. With a CVSS score of 8.8, this represents an extreme risk to the integrity of all applications managed by the affected Dokploy instance.

Remediation Plan

Immediate Action: Upgrade Dokploy to version 0.29.13 or later to apply the necessary security fixes.

Proactive Monitoring: Monitor server logs for unexpected command execution and analyze application performance for signs of unauthorized resource consumption or anomalous activity.

Compensating Controls: Implement network-level segmentation to isolate the Dokploy management plane and utilize a Web Application Firewall to sanitize incoming requests for command injection characters.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. OS command injection is a critical class of vulnerability that requires immediate attention regardless of current exploit availability.

Analyst Recommendation

The ability for an authenticated user to perform command injection is a significant security failure that must be addressed immediately. All administrators should verify their current deployment version and perform the update to 0.29.13 as soon as possible to mitigate the risk of unauthorized system control.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy is affected by an OS command injection vulnerability, enabling authenticated users to execute arbitrary commands via improper input neutralization.

Executive Summary:
An OS command injection vulnerability in Dokploy allows authenticated attackers to execute arbitrary system commands, posing a critical risk to host integrity.

Vulnerability Details

CVE-ID: CVE-2026-72874

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: The application fails to properly neutralize special elements in OS commands (CWE-78). This allows an authenticated user to bypass security controls and execute arbitrary commands on the underlying server.

Business Impact

This vulnerability provides a pathway for an authenticated attacker to gain full control over the host server. Given the CVSS score of 8.7, it is critical to address this to prevent unauthorized access, data theft, and potential ransomware deployment.

Remediation Plan

Immediate Action: Upgrade to Dokploy version 0.29.13, which contains the upstream fix for this command injection vulnerability.

Proactive Monitoring: Monitor server logs for unauthorized command execution patterns or anomalous outbound network connections from the Dokploy host.

Compensating Controls: Implement strict ingress filtering and monitor for unusual input strings in application fields that interact with system-level commands.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable if the attacker has authenticated access to the platform.

Analyst Recommendation

Administrators must update to version 0.29.13 immediately to resolve this vulnerability. Continued operation of older versions exposes the host environment to significant risk of unauthorized command execution and system takeover.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy improperly validates Bitbucket repository fields, allowing authenticated users to inject arbitrary OS commands into git clone operations.

Executive Summary:
A critical command injection flaw in Dokploy enables authenticated users to execute arbitrary commands on the host or target server.

Vulnerability Details

CVE-ID: CVE-2026-72872

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: The application fails to sanitize Bitbucket owner and repository inputs before passing them to system commands. Authenticated users with service deployment permissions can inject malicious command arguments, leading to remote code execution on the host or target server.

Business Impact

This vulnerability is rated at 9.9 on the CVSS scale, indicating a critical risk of complete system compromise. Successful exploitation allows an attacker to execute arbitrary OS commands, leading to data exfiltration, service disruption, or lateral movement within the network.

Remediation Plan

Immediate Action: Update Dokploy to version 0.29.13 or later to implement the required input validation and secure command execution.

Proactive Monitoring: Monitor server logs for unexpected git commands or shell execution patterns. Audit the activities of users with service deployment permissions for anomalous behavior.

Compensating Controls: Use a Web Application Firewall (WAF) to inspect and block suspicious input strings in API requests. Ensure that the application runs with strictly limited operating system privileges.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Aug 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to its potential for direct command execution.

Analyst Recommendation

The severity of this vulnerability necessitates an immediate update to version 0.29.13. Security teams should prioritize patching this instance to prevent potential unauthorized code execution by malicious or compromised internal accounts.

---METADATA---
VENDOR: Dokploy
PRODUCT: Dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy contains a critical missing authentication vulnerability in its platform management functions, allowing unauthorized actors to perform administrative actions.

Executive Summary:
A critical authentication bypass vulnerability in Dokploy allows unauthenticated remote attackers to perform unauthorized actions on the platform, presenting a severe risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-72871

Affected Software: Dokploy Dokploy

Affected Versions: < 0.29.13

Vulnerability: This is a missing authentication for critical function vulnerability (CWE-306). An unauthenticated remote attacker can interact with critical platform features without providing valid credentials.

Business Impact

This vulnerability allows an attacker to gain unauthorized control over platform management, potentially leading to unauthorized deployment, configuration changes, or complete system compromise. With a CVSS score of 7.5, the impact on integrity is high, as the attacker can manipulate the platform state.

Remediation Plan

Immediate Action: Upgrade all Dokploy instances to version 0.29.13 or later to enforce proper authentication checks for all critical functions.

Proactive Monitoring: Audit logs for unauthorized management actions or unexpected configuration changes that occurred prior to applying the patch.

Compensating Controls: Restrict access to the Dokploy management dashboard using VPNs or IP whitelisting to prevent exposure to the public internet until the update is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication for administrative functions.

Analyst Recommendation

This vulnerability is highly critical due to the presence of a proof-of-concept and the nature of the flaw. Immediate patching to version 0.29.13 is required to secure the platform against unauthorized administrative access.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy is susceptible to OS command injection, allowing an authenticated attacker to execute arbitrary system commands on the host.

Executive Summary:
A critical OS command injection vulnerability in Dokploy allows authenticated attackers to execute arbitrary system commands, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-72870

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: The application fails to properly neutralize special elements used in OS commands, resulting in a command injection flaw. This vulnerability requires the attacker to have low privileges (authenticated) to trigger the malicious payload.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands with the privileges of the application process. Given the CVSS score of 8.7, this represents a significant risk of unauthorized access, potential data exfiltration, and complete loss of control over the PaaS environment.

Remediation Plan

Immediate Action: Upgrade to Dokploy version 0.29.13 or later to resolve the underlying command injection flaw.

Proactive Monitoring: Monitor server access logs for unusual command patterns or unexpected process execution requests originating from the Dokploy service account.

Compensating Controls: Implement strict network segmentation and egress filtering to limit the potential impact if the application is compromised.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Command injection flaws are inherently dangerous as they grant attackers direct interaction with the underlying operating system.

Analyst Recommendation

The severity of this flaw necessitates immediate attention. Administrators should verify their current deployment version and apply the patch to 0.29.13 or higher immediately to mitigate the risk of command injection.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: >= 0.29.3, < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy versions 0.29.3 through 0.29.12 are susceptible to OS command injection due to insufficient server-side validation of git branch fields during deployment operations.

Executive Summary:
Insufficient input validation in Dokploy allows authenticated users to trigger OS command injection by supplying malicious input to Git branch configuration fields.

Vulnerability Details

CVE-ID: CVE-2026-72867

Affected Software: Dokploy dokploy

Affected Versions: >= 0.29.3, < 0.29.13

Vulnerability: This issue stems from an incomplete fix for a previous vulnerability, where server-side validation is missing for various Git branch parameters. An authenticated user can inject malicious characters into these fields, which are subsequently passed to shell-based Git commands, leading to arbitrary OS command execution on the host.

Business Impact

The vulnerability carries a CVSS score of 9.9, indicating critical severity. Successful exploitation permits an attacker to execute commands with the privileges of the Dokploy service, potentially leading to full server compromise, data theft, and the destruction of deployment environments.

Remediation Plan

Immediate Action: Upgrade to Dokploy version 0.29.13, which includes the necessary server-side validation to prevent command injection.

Proactive Monitoring: Audit configuration changes related to Git branches and monitor for unusual Git-related process execution on the host system.

Compensating Controls: Use Web Application Firewalls (WAF) to inspect and block requests containing meta-characters or shell command syntax in branch name fields if patching is delayed.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Aug 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. This flaw highlights the necessity of comprehensive server-side input validation for all user-supplied data, especially when that data interacts with system shells.

Analyst Recommendation

This vulnerability is a significant risk that could lead to total system compromise. Administrators must apply the version 0.29.13 update immediately to ensure robust input validation is enforced across all Git-related deployment functions.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A missing authorization vulnerability in Dokploy allows authenticated users to perform unauthorized actions due to improper capability checks.

Executive Summary:
A missing authorization flaw in Dokploy allows authenticated attackers to bypass security controls, posing a high risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-72866

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: The software suffers from a missing authorization vulnerability (CWE-862) which allows an attacker with low privileges to perform unauthorized actions. The attack requires the user to be authenticated to the platform.

Business Impact

Successful exploitation of this vulnerability allows an authenticated attacker to perform actions beyond their intended permission level, potentially leading to unauthorized data access, modification of system configurations, or service disruption. With a CVSS score of 8.8, this flaw represents a significant risk to the security posture of the affected PaaS environment.

Remediation Plan

Immediate Action: Update the Dokploy installation to version 0.29.13 or later as specified in the official vendor release.

Proactive Monitoring: Review administrative access logs for suspicious account activity or requests originating from low-privileged user accounts that deviate from expected behavioral patterns.

Compensating Controls: Implement strict network access controls to limit the exposure of the management interface to trusted internal networks only.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability stems from a failure to validate user capabilities during sensitive operations.

Analyst Recommendation

The vulnerability presents a high risk due to the potential for unauthorized administrative actions. Administrators should prioritize patching to version 0.29.13 immediately to eliminate the authorization bypass vector and secure the platform.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy versions prior to 0.29.13 contain an OS command injection vulnerability in the compose update process, allowing authenticated users to execute arbitrary commands on the host system.

Executive Summary:
A critical OS command injection vulnerability in Dokploy allows authenticated users to execute arbitrary commands on the host operating system with elevated privileges.

Vulnerability Details

CVE-ID: CVE-2026-72865

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: The application fails to properly sanitize the composePath variable before passing it to system shell commands. An authenticated user with sufficient permissions can inject malicious payloads into this path, resulting in arbitrary OS command execution within the context of the Dokploy host.

Business Impact

With a CVSS score of 9.9, this vulnerability allows for full system compromise. An attacker who successfully exploits this flaw can gain persistent access to the host server, modify system configurations, and pivot into other parts of the internal network, posing a catastrophic risk to organizational security.

Remediation Plan

Immediate Action: Update the Dokploy installation to version 0.29.13 to implement input validation and secure command execution practices.

Proactive Monitoring: Monitor server logs for suspicious command-line activity or child processes spawned by the Dokploy service that deviate from normal operational baselines.

Compensating Controls: Implement strict file system permissions for the user account running the Dokploy service to limit the impact of potential command execution.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Aug 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The reliance on shell-based execution without sufficient sanitization makes this a high-value target for attackers.

Analyst Recommendation

This is a critical security flaw that enables complete host takeover. Given the ease of triggering this via the compose update functionality, all instances should be patched to version 0.29.13 without delay.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An OS command injection vulnerability in Dokploy prior to 0.29.13 allows authenticated users with deployment permissions to execute arbitrary commands on the host by manipulating SSH host settings.

Executive Summary:
A critical OS command injection vulnerability in Dokploy allows authenticated attackers to execute arbitrary system commands, leading to a full compromise of the underlying host server.

Vulnerability Details

CVE-ID: CVE-2026-72740

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: The vulnerability exists due to improper neutralization of user-controlled input when building SSH commands, allowing an authenticated user to inject malicious shell commands that are executed with the privileges of the Dokploy service.

Business Impact

An attacker who successfully exploits this vulnerability gains full control over the host server where Dokploy is running. This allows for total system compromise, data theft, and the ability to pivot into other parts of the internal infrastructure, justifying the 9.9 CVSS severity rating.

Remediation Plan

Immediate Action: Upgrade Dokploy to version 0.29.13 or later to ensure proper input sanitization is applied to SSH-related commands.

Proactive Monitoring: Monitor system process logs for suspicious commands executed by the service account user and look for unauthorized changes to SSH configuration files.

Compensating Controls: Restrict access to the service deployment feature to only highly trusted individuals and ensure the application is containerized with restricted filesystem permissions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable for any authenticated user with deployment rights.

Analyst Recommendation

This is a high-severity command injection flaw that requires immediate attention. Organizations must upgrade to the patched version as soon as possible to prevent potential unauthorized system-level code execution.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An OS command injection vulnerability in the Dokploy backup endpoint allows authenticated users to execute arbitrary commands on the host server.

Executive Summary:
A critical OS command injection flaw in Dokploy allows authenticated users to execute arbitrary commands on the host server, resulting in total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-72738

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: The vulnerability resides in the backup.listBackupFiles tRPC endpoint, which fails to properly sanitize the search parameter before passing it to an OS command. This allows an authenticated user with backup read permissions to perform command injection on the host.

Business Impact

Successful exploitation grants an attacker the ability to execute arbitrary commands on the host server, effectively bypassing application-level security. This can lead to full server compromise, data exfiltration, and lateral movement within the network. The 9.9 CVSS score highlights the severity of this remote code execution risk.

Remediation Plan

Immediate Action: Update Dokploy to version 0.29.13 or later to implement the necessary command sanitization.

Proactive Monitoring: Monitor server logs for shell-related commands originating from the Dokploy process and look for anomalous file system interactions.

Compensating Controls: Restrict access to the backup management features and implement egress filtering to prevent the server from reaching unauthorized external hosts.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of Aug 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous because it allows direct interaction with the host operating system.

Analyst Recommendation

Immediate patching is required to eliminate this command injection risk. Administrators should also review logs for any evidence of unauthorized backup file access or suspicious command execution since the deployment of the affected versions.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: <= 0.29.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A cross-tenant authorization bypass in Dokploy versions 0.29.8 and earlier allows authenticated users with backup permissions to access or poison backup data belonging to other organizations.

Executive Summary:
A critical authorization bypass in Dokploy allows authenticated users to access or manipulate sensitive backup data across different organizational boundaries.

Vulnerability Details

CVE-ID: CVE-2026-72737

Affected Software: Dokploy dokploy

Affected Versions: <= 0.29.8

Vulnerability: The application fails to verify that the destinationId provided in backup API requests belongs to the authenticated user's organization. This allows an attacker with legitimate backup permissions to access or poison S3 credentials and data belonging to other tenants.

Business Impact

With a CVSS score of 9.6, this vulnerability permits severe cross-tenant data exposure and manipulation. An attacker can exfiltrate sensitive backup data, including S3 access keys, or poison backups, which could lead to widespread data loss or unauthorized access across the entire Platform as a Service (PaaS) environment.

Remediation Plan

Immediate Action: Update Dokploy to version 0.29.9 or later to incorporate the necessary cross-organization authorization checks.

Proactive Monitoring: Audit access logs for backup-related API requests and monitor for anomalous cross-tenant activity or unauthorized attempts to access backup destinations.

Compensating Controls: Restrict administrative access to backup management features to a minimal set of trusted users until the patch can be fully deployed.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw highlights a critical failure in multi-tenant isolation logic.

Analyst Recommendation

This vulnerability is highly severe for any multi-tenant deployment, as it breaks the fundamental isolation between organizations. It is imperative to update to the latest version immediately to restore proper authorization controls and protect tenant data integrity.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An incomplete fix for a previous vulnerability allows authenticated users to perform OS command injection on remote servers managed by Dokploy through manipulated Traefik configuration settings.

Executive Summary:
A critical command injection vulnerability in Dokploy permits authenticated users to execute arbitrary commands on remote managed servers via malformed Traefik configurations.

Vulnerability Details

CVE-ID: CVE-2026-72735

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: The writeTraefikConfigRemote function fails to properly neutralize shell metacharacters when processing user-controlled Traefik configurations. This flaw, which serves as an incomplete fix for CVE-2026-45630, allows an authenticated attacker to inject arbitrary commands that execute with the privileges of the configured SSH user on remote servers.

Business Impact

With a CVSS score of 9.9, this vulnerability represents an extreme risk to the integrity and security of remote managed infrastructure. An attacker can pivot from the Dokploy control plane to gain full control over connected remote servers, leading to widespread system compromise and potential data exfiltration across the entire managed environment.

Remediation Plan

Immediate Action: Upgrade all instances of Dokploy to version 0.29.13 or later to remediate the insecure configuration handling.

Proactive Monitoring: Audit remote server access logs and monitor for unusual SSH command patterns originating from the Dokploy control plane.

Compensating Controls: Implement strict SSH key-based authentication with limited privileges for the service users utilized by Dokploy to minimize the impact of command execution.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly dangerous as it allows remote code execution across multiple managed nodes.

Analyst Recommendation

This vulnerability requires immediate attention due to its potential for remote infrastructure takeover. Organizations must update their Dokploy deployments to version 0.29.13 or later to ensure that configuration inputs are correctly neutralized and the attack vector is closed.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: >= 0.28.7, < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy contains an authorization bypass vulnerability allowing authenticated users to access resources via user-controlled keys.

Executive Summary:
A critical authorization bypass vulnerability in Dokploy allows authenticated users to access unauthorized resources, posing a severe risk to platform integrity.

Vulnerability Details

CVE-ID: CVE-2026-72734

Affected Software: Dokploy dokploy

Affected Versions: >= 0.28.7, < 0.29.13

Vulnerability: This vulnerability, identified as CWE-639, stems from improper authorization checks where a user-controlled key can be manipulated to bypass access controls. The vulnerability requires the attacker to have an authenticated user account to influence the resource key.

Business Impact

The vulnerability carries a CVSS score of 8.4, reflecting its potential for total impact on system confidentiality and integrity. Successful exploitation allows an attacker with low-level privileges to perform unauthorized actions or access data outside their assigned scope, potentially leading to a full compromise of hosted applications or sensitive environment configurations.

Remediation Plan

Immediate Action: Upgrade to Dokploy version 0.29.13 or later immediately to apply the vendor-provided patch.

Proactive Monitoring: Review audit logs for suspicious API requests or unexpected resource access patterns that deviate from normal user behavior.

Compensating Controls: Ensure that the Dokploy instance is not exposed to the public internet unless strictly necessary, and enforce strict network segmentation for the underlying host.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw highlights a critical failure in the application's authorization logic regarding user identifiers.

Analyst Recommendation

Given the High severity and the existence of a proof-of-concept, administrators should prioritize updating the Dokploy installation. Failure to apply this patch may allow authenticated users to escalate their access, leading to significant unauthorized data exposure or administrative control within the PaaS environment.

---METADATA---
VENDOR: Dokploy
PRODUCT: dokploy
AFFECTED_VERSIONS: < 0.29.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Dokploy versions before 0.29.13 are vulnerable to OS command injection in the backup restore functionality, allowing authenticated users to execute arbitrary commands within the host context.

Executive Summary:
An authenticated OS command injection vulnerability in the backup restoration feature of Dokploy versions prior to 0.29.13 allows attackers to gain full control over the host system.

Vulnerability Details

CVE-ID: CVE-2026-72733

Affected Software: Dokploy dokploy

Affected Versions: < 0.29.13

Vulnerability: This is an OS command injection vulnerability (CWE-78) where user-provided input in the backup restore process is not properly sanitized before being passed to shell pipelines. An authenticated user with backup-restore permissions can inject arbitrary commands that execute in the context of the host server.

Business Impact

The vulnerability allows for full host-level command execution, which is critical given the CVSS score of 9.9. Successful exploitation results in complete system compromise, enabling attackers to extract sensitive data, deploy persistent backdoors, or disrupt service availability for the entire platform.

Remediation Plan

Immediate Action: Upgrade to Dokploy version 0.29.13 or later, which includes the necessary input sanitization to prevent command injection.

Proactive Monitoring: Monitor the system for unusual child processes being spawned by the Dokploy backup service or unexpected outbound network connections.

Compensating Controls: Restrict access to the backup-restore functionality to only the most trusted administrative accounts until the patch is applied.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of Aug 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable by any user with standard administrative access to the platform.

Analyst Recommendation

The severity of this flaw requires immediate remediation. All Dokploy users should update to version 0.29.13 immediately to eliminate the risk of host-level command injection via the backup restoration module.

---METADATA---
VENDOR: Dokploy
PRODUCT: PaaS
AFFECTED_VERSIONS: 0.26.5 and earlier
---END_METADATA---

Description Summary:
A path traversal vulnerability in Dokploy allows authenticated users to write arbitrary files to the host or remote servers during application deployment, leading to full system compromise.

Executive Summary:
A critical path traversal flaw in Dokploy allows authenticated users to overwrite files and execute arbitrary code on the host or remote servers.

Vulnerability Details

CVE-ID: CVE-2026-45661

Affected Software: Dokploy PaaS

Affected Versions: 0.26.5 and earlier

Vulnerability: The vulnerability allows path traversal during application deployment. By crafting malicious deployment packages, an authenticated user can write files to sensitive locations, enabling persistent backdoors, cron job manipulation, and arbitrary remote code execution on both the local host and remote deployment targets.

Business Impact

With a CVSS score of 9.9, this vulnerability is critical. It bypasses container isolation mechanisms, meaning even remote servers managed by Dokploy are at risk of total compromise. The ability to install backdoors and exfiltrate data represents a major threat to organizational infrastructure.

Remediation Plan

Immediate Action: Update to the latest version of Dokploy (check vendor advisory for available patches).

Proactive Monitoring: Monitor deployment logs for suspicious file paths and review server cron jobs for unauthorized entries or unexpected modifications.

Compensating Controls: Limit access to the deployment features and implement strict filesystem permissions to prevent unauthorized writes outside of expected application directories.

Exploitation Status

Public Exploit Available: None

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant risk to the entire managed infrastructure. Administrators must prioritize updating their Dokploy installation and auditing their deployment pipelines for any signs of unauthorized file modifications.

---METADATA---
VENDOR: Dokploy
PRODUCT: PaaS
AFFECTED_VERSIONS: 0.26.7 and earlier
---END_METADATA---

Description Summary:
A broken access control vulnerability in the Dokploy schedule router allows authenticated users to manage schedules belonging to other organizations, leading to RCE.

Executive Summary:
A lack of authorization checks in the Dokploy schedule router enables authenticated users to perform unauthorized actions, leading to potential RCE.

Vulnerability Details

CVE-ID: CVE-2026-45632

Affected Software: Dokploy PaaS

Affected Versions: 0.26.7 and earlier

Vulnerability: The schedule router fails to enforce organization and role-based access control. Any authenticated user can interact with schedules across the platform if they possess the relevant identifiers, allowing them to execute scripts on host or remote servers.

Business Impact

With a CVSS score of 9.9, this is a critical vulnerability. It facilitates cross-organization data and system access, enabling any authenticated user to gain Remote Code Execution (RCE) on both the central Dokploy host and any managed target server.

Remediation Plan

Immediate Action: Update to the latest version of Dokploy.

Proactive Monitoring: Review audit logs for unauthorized schedule modifications or executions and verify that only authorized users have access to sensitive schedule identifiers.

Compensating Controls: Implement strict identity and access management (IAM) policies and limit access to the Dokploy instance to authorized organization members only.

Exploitation Status

Public Exploit Available: None

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Immediate patching is required to restore proper access control. Administrators should also conduct a review of existing schedules to ensure no malicious tasks were created during the period of exposure.

---METADATA---
VENDOR: Dokploy
PRODUCT: PaaS
AFFECTED_VERSIONS: 0.27.0 to before 0.29.3
---END_METADATA---

Description Summary:
A hardcoded authentication secret in Dokploy allows unauthenticated attackers to forge JWTs, gain administrative access, and execute commands on the host system via SSH.

Executive Summary:
A hardcoded authentication secret in Dokploy enables unauthenticated attackers to bypass security controls and gain full administrative control over the host.

Vulnerability Details

CVE-ID: CVE-2026-45631

Affected Software: Dokploy PaaS

Affected Versions: 0.27.0 to before 0.29.3

Vulnerability: The application utilizes a hardcoded fallback secret ("better-auth-secret-123456789") for JWT signing. This flaw allows an unauthenticated attacker to forge email verification tokens, authenticate as an administrator, and leverage the built-in SSH terminal to execute arbitrary commands.

Business Impact

With a CVSS score of 10, this is a maximum-severity vulnerability. It allows any unauthenticated attacker to bypass all authentication mechanisms, leading to full unauthorized access to the PaaS environment and the underlying host server. This could result in total data loss, system destruction, or deep-seated persistence within the network.

Remediation Plan

Immediate Action: Update Dokploy to version 0.29.3 or later immediately.

Proactive Monitoring: Review all authentication logs for suspicious administrative sign-ins and investigate the creation of unauthorized SSH sessions or unexpected terminal activity.

Compensating Controls: Ensure the management interface is not exposed to the public internet and require VPN access for all administrative operations.

Exploitation Status

Public Exploit Available: None

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is critical and represents a complete security failure. Administrators must ensure the software is updated to the patched version 0.29.3 immediately to prevent potential account takeover and remote code execution.

---METADATA---
VENDOR: Dokploy
PRODUCT: PaaS
AFFECTED_VERSIONS: 0.28.8 and earlier
---END_METADATA---

Description Summary:
An OS command injection vulnerability in the Dokploy /listen-deployment WebSocket endpoint allows authenticated users to execute arbitrary commands on remote servers.

Executive Summary:
An OS command injection flaw in the Dokploy WebSocket interface allows authenticated users to execute arbitrary code on managed remote servers.

Vulnerability Details

CVE-ID: CVE-2026-45629

Affected Software: Dokploy PaaS

Affected Versions: 0.28.8 and earlier

Vulnerability: The /listen-deployment WebSocket endpoint fails to properly sanitize user input, leading to OS command injection. Authenticated organization members can abuse this to execute commands on remote servers managed by the Dokploy instance.

Business Impact

This vulnerability carries a CVSS score of 9.9, reflecting the risk of full server compromise across the entire managed infrastructure. An attacker with standard user access can escalate to full control over remote servers, leading to lateral movement and widespread system disruption.

Remediation Plan

Immediate Action: Update to the latest version of Dokploy.

Proactive Monitoring: Monitor WebSocket traffic for suspicious payloads and review remote server logs for unauthorized command execution.

Compensating Controls: Restrict access to the Dokploy management console to trusted personnel and implement network-level egress filtering on managed servers to block unauthorized outbound connections from injected processes.

Exploitation Status

Public Exploit Available: None

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should update their Dokploy instance immediately. Given the potential for lateral movement, a thorough audit of all managed remote servers is recommended to ensure no unauthorized persistence has been established.

---METADATA---
VENDOR: Dokploy
PRODUCT: Dokploy
AFFECTED_VERSIONS: 0.26.6 and below
---END_METADATA---

Description Summary:
Dokploy 0.26.6 and below contain an OS command injection vulnerability in the appName parameter, allowing authenticated attackers to execute arbitrary commands with server-level privileges.

Executive Summary:
An authenticated OS command injection vulnerability in Dokploy allows attackers to achieve server-level code execution, leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-27130

Affected Software: Dokploy

Affected Versions: 0.26.6 and below

Vulnerability: The application fails to properly sanitize the appName parameter before passing it to system shell commands, allowing an authenticated attacker to inject shell metacharacters.

Business Impact

The CVSS score of 9.9 reflects the high severity of this command injection. An authenticated attacker can escalate their access to full server control, potentially destroying the PaaS environment or gaining access to all hosted applications and their associated data.

Remediation Plan

Immediate Action: Upgrade Dokploy to version 0.26.7 or later.

Proactive Monitoring: Review application logs for unexpected shell commands or character sequences in the appName field.

Compensating Controls: Implement strict input validation on the application creation interface and limit user access to sensitive administrative functions.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.