Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-45661: Dokploy 0.26.5 and Earlier: Authenticated Users Can Write Arbitrary Files

CVE-2026-45661

Summary

Dokploy's self-hosted service, used by administrators to deploy applications, has a security flaw that allows authorized users to create unwanted files on the server. This could lead to unauthorized access, data theft, or even complete server takeover. To stay secure, update Dokploy to the latest version as soon as possible.

Original title

Original description

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.5 and earlier, a critical path traversal vulnerability exists in Dokploy v0.26.5 that allows authenticated users to write arbitrary files to the filesystem during application deployment. When combined with Dokploy's remote server deployment feature, this vulnerability enables arbitrary file write to remote server filesystems, automatic remote code execution via cron jobs, complete server compromise, data exfiltration without user interaction, and persistent backdoor installation. This vulnerability bypasses all container isolation on remote server deployments.

nvd CVSS3.1 9.9

Vulnerability type

CWE-22 Path Traversal

CWE-35

https://github.com/Dokploy/dokploy/security/advisories/GHSA-66v7-g3fh-47h3

Published: 29 May 2026 · Updated: 31 May 2026 · First seen: 29 May 2026