Command Injection Vulnerability in Dokploy Platform by Dokploy
CVE-2025-53376

6.3MEDIUM

Key Information:

Vendor

Dokploy

Status
Dokploy
Vendor
CVE Published:
7 July 2025

What is CVE-2025-53376?

An authenticated, low-privileged user can exploit Dokploy, a Platform as a Service (PaaS), to execute arbitrary operating system commands on the host system. This vulnerability arises because the tRPC procedure docker.getContainersByAppNameMatch integrates an attacker-influenced appName value into a Docker CLI command without appropriate sanitization. As a result, a command injection could occur under the Dokploy service account. This issue has been addressed in version 0.23.7.

Affected Version(s)

dokploy < 0.23.7

References

https://github.com/Dokploy/dokploy/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/Dokploy/dokploy/commit/fb5d2bd5b67322f...
x_refsource_MISC

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.