CVE-2026-45628
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Dokploy, a self-hosted PaaS, in version 0.29.2 and earlier constructs shell commands using JavaScript template literals and executes them via child_process.exec() without proper escaping of user input.
Risk Assessment
An authenticated attacker with application creation privileges can inject arbitrary shell commands, leading to remote code execution on the server.
Recommendation
Update Dokploy to a version later than 0.29.2, which contains the fix.
Original NVD description (English source)
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.2 and earlier, Dokploy constructs shell commands using JavaScript template literals and executes them via child_process.exec() (which runs through /bin/sh -c). User-supplied branch names, repository URLs, and Docker credentials are interpolated directly into these commands without escaping. This requires an authenticated user with application create/edit privileges.