https://cvebrief.com/archive/cves/vendor/dokploy/ High and critical Dokploy vulnerabilities covered by CVE Brief, with independent analyst commentary. en-us Tue, 01 Sep 2026 12:00:00 GMT https://cvebrief.com/cve/cve-2026-82954/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-82954 Tue, 01 Sep 2026 12:00:00 GMT Dokploy versions up to 0.29.7 contain a path traversal vulnerability in the writeTraefikConfigInPath function, allowing authenticated attackers to manipulate file paths remotely. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-45790/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-45790 Tue, 18 Aug 2026 12:00:00 GMT Dokploy is a free, self-hostable Platform as a Service (PaaS) Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72733/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72733 Tue, 11 Aug 2026 12:00:00 GMT Dokploy versions before 0.29.13 are vulnerable to OS command injection in the backup restore functionality, allowing authenticated users to execute arbitrary commands within the host context. Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72734/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72734 Tue, 11 Aug 2026 12:00:00 GMT Dokploy is a free, self-hostable Platform as a Service (PaaS) Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72735/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72735 Tue, 11 Aug 2026 12:00:00 GMT An incomplete fix for a previous vulnerability allows authenticated users to perform OS command injection on remote servers managed by Dokploy through manipulated Traefik configuration settings. Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72736/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72736 Tue, 11 Aug 2026 12:00:00 GMT Dokploy contains a command injection vulnerability in its registry credential and Docker Swarm management endpoints, allowing authenticated users to execute arbitrary commands on the host. Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72737/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72737 Tue, 11 Aug 2026 12:00:00 GMT A cross-tenant authorization bypass in Dokploy versions 0.29.8 and earlier allows authenticated users with backup permissions to access or poison backup data belonging to other organizations. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72738/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72738 Tue, 11 Aug 2026 12:00:00 GMT An OS command injection vulnerability in the Dokploy backup endpoint allows authenticated users to execute arbitrary commands on the host server. Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72740/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72740 Tue, 11 Aug 2026 12:00:00 GMT An OS command injection vulnerability in Dokploy prior to 0.29.13 allows authenticated users with deployment permissions to execute arbitrary commands on the host by manipulating SSH host settings. Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72862/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72862 Tue, 11 Aug 2026 12:00:00 GMT Dokploy contains an OS command injection vulnerability in its database service deployment functions, allowing authenticated users to execute arbitrary commands on the remote server. Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72863/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72863 Tue, 11 Aug 2026 12:00:00 GMT Dokploy versions prior to 0.29.13 fail to enforce authorization checks on WebSocket handlers, allowing authenticated users to access interactive shells and escalate privileges to root. Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72864/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72864 Tue, 11 Aug 2026 12:00:00 GMT Dokploy versions before 0.29.13 are vulnerable to a missing authorization flaw in the docker-container-terminal component, allowing authenticated users to gain a root shell in arbitrary containers. Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72865/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72865 Tue, 11 Aug 2026 12:00:00 GMT Dokploy versions prior to 0.29.13 contain an OS command injection vulnerability in the compose update process, allowing authenticated users to execute arbitrary commands on the host system. Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72866/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72866 Tue, 11 Aug 2026 12:00:00 GMT Dokploy is a free, self-hostable Platform as a Service (PaaS) Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72867/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72867 Tue, 11 Aug 2026 12:00:00 GMT Dokploy versions 0.29.3 through 0.29.12 are susceptible to OS command injection due to insufficient server-side validation of git branch fields during deployment operations. Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72868/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72868 Tue, 11 Aug 2026 12:00:00 GMT Dokploy allows a low-privileged member to execute arbitrary OS commands as root by injecting malicious input into the rclone configuration fields during test connection operations. Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72869/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72869 Tue, 11 Aug 2026 12:00:00 GMT An OS command injection vulnerability in Dokploy prior to 0.29.13 allows authenticated users with backup permissions to execute arbitrary commands in the host context via crafted database names. Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72870/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72870 Tue, 11 Aug 2026 12:00:00 GMT Dokploy is a free, self-hostable Platform as a Service (PaaS) Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72871/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72871 Tue, 11 Aug 2026 12:00:00 GMT Dokploy is a free, self-hostable Platform as a Service (PaaS) Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72872/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72872 Tue, 11 Aug 2026 12:00:00 GMT Dokploy improperly validates Bitbucket repository fields, allowing authenticated users to inject arbitrary OS commands into git clone operations. Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72874/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72874 Tue, 11 Aug 2026 12:00:00 GMT Dokploy is a free, self-hostable Platform as a Service (PaaS) Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72875/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72875 Tue, 11 Aug 2026 12:00:00 GMT Dokploy is a free, self-hostable Platform as a Service (PaaS) Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72876/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72876 Tue, 11 Aug 2026 12:00:00 GMT Dokploy versions before 0.29.13 contain an authorization bypass and OS command injection flaw, allowing authenticated users to manipulate server IDs and execute commands on other tenants' servers. Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72877/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72877 Tue, 11 Aug 2026 12:00:00 GMT Dokploy versions before 0.29.13 are vulnerable to OS command injection via the dockerImage field, allowing authenticated users to execute arbitrary commands on build hosts. Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72878/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72878 Tue, 11 Aug 2026 12:00:00 GMT Dokploy prior to 0.29.13 is vulnerable to OS command injection via the backup and restore pipeline, allowing authenticated admins to execute arbitrary commands on the host machine. Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72879/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72879 Tue, 11 Aug 2026 12:00:00 GMT Dokploy versions prior to 0.29.8 are vulnerable to OS command injection via the getRegistryCommands function, allowing authenticated users to execute arbitrary commands on the host server. Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72880/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72880 Tue, 11 Aug 2026 12:00:00 GMT Dokploy versions before 0.29.13 contain an arbitrary file write and deletion vulnerability due to improper input validation in the certificate management service. Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72882/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72882 Tue, 11 Aug 2026 12:00:00 GMT Dokploy versions 0.28.8 and earlier are vulnerable to OS command injection via the filePath parameter, allowing authenticated users to execute arbitrary commands on remote servers. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72883/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72883 Tue, 11 Aug 2026 12:00:00 GMT Dokploy is a free, self-hostable Platform as a Service (PaaS) Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72884/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72884 Tue, 11 Aug 2026 12:00:00 GMT Dokploy is a free, self-hostable Platform as a Service (PaaS) Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72886/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72886 Tue, 11 Aug 2026 12:00:00 GMT An improper privilege management vulnerability in Dokploy allows authenticated users to escalate privileges and execute arbitrary scripts as root on the host machine. Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72901/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72901 Tue, 11 Aug 2026 12:00:00 GMT Dokploy versions prior to 0.29.13 are susceptible to OS command injection via the volume backup functionality, allowing authenticated low-privilege users to execute commands with root-level impact. Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-72902/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-72902 Tue, 11 Aug 2026 12:00:00 GMT Dokploy versions before 0.29.13 are vulnerable to OS command injection via the registry testing functions, allowing authenticated users to execute arbitrary commands on the host or remote server. Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-45629/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-45629 Sat, 30 May 2026 12:00:00 GMT An OS command injection vulnerability in the Dokploy /listen-deployment WebSocket endpoint allows authenticated users to execute arbitrary commands on remote servers. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-45631/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-45631 Sat, 30 May 2026 12:00:00 GMT A hardcoded authentication secret in Dokploy allows unauthenticated attackers to forge JWTs, gain administrative access, and execute commands on the host system via SSH. Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-45632/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-45632 Sat, 30 May 2026 12:00:00 GMT A broken access control vulnerability in the Dokploy schedule router allows authenticated users to manage schedules belonging to other organizations, leading to RCE. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-45633/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-45633 Sat, 30 May 2026 12:00:00 GMT Dokploy contains a command injection vulnerability in the /docker-container-logs WebSocket endpoint that allows authenticated users to execute arbitrary commands with root privileges. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-45661/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-45661 Sat, 30 May 2026 12:00:00 GMT A path traversal vulnerability in Dokploy allows authenticated users to write arbitrary files to the host or remote servers during application deployment, leading to full system compromise. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-45662/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-45662 Sat, 30 May 2026 12:00:00 GMT Dokploy is a free, self-hostable Platform as a Service (PaaS) Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-45663/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-45663 Sat, 30 May 2026 12:00:00 GMT Dokploy contains a command injection vulnerability in its Docker file upload functionality that allows authenticated users to execute arbitrary OS commands. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-27130/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-27130 Tue, 19 May 2026 12:00:00 GMT Dokploy 0.26.6 and below contain an OS command injection vulnerability in the appName parameter, allowing authenticated attackers to execute arbitrary commands with server-level privileges. Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-24840/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-24840 Wed, 28 Jan 2026 12:00:00 GMT Dokploy is a free, self-hostable Platform as a Service (PaaS) Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-24841/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2026-24841 Wed, 28 Jan 2026 12:00:00 GMT Dokploy is a free, self-hostable Platform as a Service (PaaS). Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2025-53825/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-dokploy-CVE-2025-53825 Mon, 14 Jul 2025 12:00:00 GMT Dokploy is a free, self-hostable Platform as a Service (PaaS). Fix documented (OSV.dev). Independent analyst report on CVE Brief.