CVE-2026-45663
Dokploy, a free self‑hosted Platform as a Service, has a critical command injection flaw in its Docker file upload feature. In versions 0.29.1 and earlier, an authenticated user can supply a malicious destination path that is not sanitized, allowing the attacker to run arbitrary shell commands on the host. The vulnerability is severe because it gives attackers full control over the underlying operating system.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Dokploy Platform as a Service, version 0.29.1 and earlier, for users who can authenticate and upload files to containers.
Real-world impact
An attacker who can log into Dokploy and upload a file can execute any command on the host machine, potentially taking full control of the server, stealing data, or installing malware.
Why this severity
The CVSS score of 9.9 reflects that the attack can be performed over the network by an attacker with low effort and low privileges, requires no user interaction, and compromises confidentiality, integrity, and availability of the entire system.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- May 29, 2026 · May 29, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 14d agoAdvisory updatedThe NVD record was last revised.