Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

Dokploy lets logged‑in users run any command

CVE-2026-45633 · published 5 months ago
Summary

Versions of Dokploy up to 0.26.6 let a signed‑in user send specially crafted requests to the /docker-container-logs feature and cause the system to run arbitrary commands with full administrator rights. This could let an attacker take control of the server hosting Dokploy. Upgrade to the latest release that fixes the input handling, or restrict access to the web interface to trusted users only.

Original advisory text
Dokploy: Command Injection in /docker-container-logs Endpoint
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.6 and earlier, Dokploy contains a command injection vulnerability in the /docker-container-logs WebSocket endpoint. The tail and since parameters are not validated and are directly concatenated into shell commands, allowing authenticated users to execute arbitrary commands with root privileges.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
9.9 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published29 May 2026
Updated4 Nov 2026
First seen29 May 2026
Sources
CVE-2026-45633 · NVD
CVE-2026-45633 · OSV
GHSA-wmqj-wr9q-327p · GHSA
Track software like this
Free during beta