CVE-2026-45633
CriticalCVSS 9.9Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
Dokploy in version 0.26.6 and earlier has a command injection vulnerability in the /docker-container-logs WebSocket endpoint. The tail and since parameters are not validated and are directly concatenated into shell commands, allowing authenticated users to execute arbitrary commands with root privileges.
Risk Assessment
An authenticated attacker can execute arbitrary commands with root privileges, leading to full compromise of the Dokploy platform and its managed containers.
Recommendation
Upgrade Dokploy to version 0.26.7 or later, which contains the fix.
Original NVD description (English source)
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.6 and earlier, Dokploy contains a command injection vulnerability in the /docker-container-logs WebSocket endpoint. The tail and since parameters are not validated and are directly concatenated into shell commands, allowing authenticated users to execute arbitrary commands with root privileges.