Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-93425: Dokploy allows authenticated user to run commands as root
CVE-2026-93425 · published 1 day ago
Summary
In Dokploy versions before 0.29.13, a user who is logged in and has read access can trick the system into running any command they choose with full administrator rights inside the Dokploy container. Because the container can control Docker, this could let an attacker take over the host server and any applications it manages. Upgrade to version 0.29.13 or later to stop the problem.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| dokploy | dokploy | < 0.29.13 |
Original advisory text
Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe argument quoting. An authenticated organization member with service:read permission can inject shell metacharacters into repoPath and execute arbitrary commands through child_process.exec as root in the Dokploy container. The supplied service identifier is used only to resolve the server and does not constrain repoPath. Because the standard deployment mounts /var/run/docker.sock, container-root command execution can be used to control Docker and compromise the host and its managed applications. This issue is fixed in version 0.29.13.
References
- https://github.com/Dokploy/dokploy/security/advisories/GHSA-56g6-wjr4-5q7p Vendor Advisory
- https://github.com/Dokploy/dokploy/commit/16b5b7293f9883327a89c69fcb6e5718767b06... Patch
- https://github.com/Dokploy/dokploy/releases/tag/v0.29.13 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93425... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-93425 Vendor Advisory
Severity
9.9
Critical
CVSS 3.1: 9.9 (MITRE)
Type
CWE-78OS Command Injection
Timeline
Published24 Sep 2026
Updated25 Sep 2026
First seen24 Sep 2026
Track software like this
Free during beta