CVE-2026-45630

CriticalCVSS 9.0

Published: 29/05/2026(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.76%

52th percentile - higher than 52% of all known CVEs

Summary

Dokploy 0.28.8 and earlier contains an authenticated OS command injection vulnerability in the application.updateTraefikConfig tRPC endpoint. Admin/owner users can execute arbitrary system commands on remote servers via unsanitized echo shell interpolation.

Risk Assessment

An attacker with admin privileges can take over remote servers managed by Dokploy, leading to full compromise.

Recommendation

Update Dokploy to version 0.28.9 or later which fixes this vulnerability, and restrict access to tRPC endpoints.

Original NVD description (English source)

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, authenticated OS command injection in the application.updateTraefikConfig tRPC endpoint allows admin/owner users to execute arbitrary system commands on remote servers via unsanitized echo shell interpolation.