CVE-2026-45663
CriticalCVSS 9.9Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
In Dokploy version 0.29.1 and earlier, a command injection vulnerability exists in the Docker file upload functionality. The destinationPath parameter is not properly sanitized and is directly interpolated into a shell command, allowing an authenticated user to execute arbitrary OS commands on the Dokploy host.
Risk Assessment
An attacker can take over the Dokploy server, compromising the confidentiality, integrity, and availability of data and services hosted on the platform.
Recommendation
Immediately upgrade Dokploy to a version later than 0.29.1 where the vulnerability is patched. Until then, restrict access to the file upload functionality to trusted users only.
Original NVD description (English source)
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.1 and earlier, a command injection vulnerability exists in the Docker file upload functionality. When an authenticated user uploads a file to a container, the destinationPath parameter is not properly sanitized and is directly interpolated into a shell command string. By including shell metacharacters such as ; or ", an attacker can escape the intended docker cp command and execute arbitrary OS commands on the Dokploy host.