CVE-2026-27130
Dokploy, a free self‑hosted Platform as a Service, has a critical OS command injection flaw in versions 0.26.6 and earlier. The flaw lets an authenticated user inject shell commands through the appName field when creating an application, and the commands run with server‑level privileges during service operations.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Dokploy Platform as a Service, versions 0.26.6 and earlier, used by self‑hosted deployments.
Real-world impact
An attacker who can create or manage applications can run arbitrary shell commands on the host machine, potentially taking full control of the server.
Why this severity
The CVSS score of 9.9 reflects that the vulnerability is network reachable, requires low effort, low privilege, no user interaction, and can compromise confidentiality, integrity, and availability of the entire system.
What to do about it
- 011. Upgrade Dokploy to version 0.26.7 or later.
- 022. Restart the Dokploy service to ensure the new version is running.
NVD-referenced vendor advisory
Timeline
- May 18, 2026 · May 18, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
- Jul 25, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.