CVE-2026-45661
Dokploy v0.26.5 and earlier contains a critical path traversal vulnerability (CWE-22) allowing authenticated users to write arbitrary files during deployment. This can lead to remote code execution, server compromise, and data exfiltration when combined with remote server deployment features.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users of Dokploy v0.26.5 and earlier
Real-world impact
Attackers could exploit this to gain full server control, steal data, or install persistent backdoors without user interaction.
Why this severity
CVSS 9.9 (critical): High impact on confidentiality, integrity, and availability with network accessibility and low attack complexity.
What to do about it
- ›Disable remote server deployment features until a patch is available.
- ›Restrict file write permissions on Dokploy's filesystem directories to prevent unauthorized writes.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No official fix documented in sources. Mitigations based on vulnerability description.
Timeline
- May 29, 2026 · May 29, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.