Command Injection Flaw in Dokploy PaaS Affects User-Provided Inputs
CVE-2026-45628

9.6CRITICAL

Key Information:

Vendor

Dokploy

Status
Dokploy
Vendor
CVE Published:
29 May 2026

What is CVE-2026-45628?

Dokploy, a free, self-hostable Platform as a Service (PaaS), is vulnerable due to its method of constructing shell commands using JavaScript template literals. In versions up to 0.29.2, it interpolates user-supplied branch names, repository URLs, and Docker credentials directly into shell commands executed via child_process.exec() without proper escaping. This introduces a command injection vulnerability that can be exploited by an authenticated user who has privileges to create or edit applications, potentially compromising the system's integrity and security.

Affected Version(s)

dokploy <= 0.29.2

References

https://github.com/Dokploy/dokploy/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.