PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45663 Dokploy CVE debrief

A critical command injection vulnerability in Dokploy's Docker file upload functionality allows authenticated attackers to execute arbitrary OS commands on the host. The flaw exists in versions 0.29.1 and earlier, where the destinationPath parameter is unsafely interpolated into shell commands during docker cp operations. Attackers can inject shell metacharacters to escape the intended command context. This vulnerability carries a CVSS 3.1 score of 9.9 (Critical) with network attack vector, low complexity, and high impacts across confidentiality, integrity, and availability. The issue was disclosed via GitHub Security Advisory and is tracked in NVD with deferred status. No known exploitation in ransomware campaigns has been reported.

Vendor
Dokploy
Product
Unknown
CVSS
CRITICAL 9.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-05-29
Advisory published
2026-05-29
Advisory updated
2026-05-29

Who should care

Organizations running self-hosted Dokploy instances for application deployment and container management, particularly those exposing administrative interfaces to broader networks or with multi-tenant access patterns.

Technical summary

The vulnerability resides in Dokploy's file upload feature for containers. When an authenticated user uploads a file, the destinationPath parameter is concatenated directly into a shell command string without proper sanitization. This allows injection of shell control characters (semicolons, quotes, backticks, etc.) that terminate the intended docker cp command and introduce arbitrary command execution. The attack requires valid authentication but no user interaction, and successful exploitation grants command execution on the Dokploy host with potential container escape implications due to docker daemon access.

Defensive priority

critical

Recommended defensive actions

  • Upgrade Dokploy to a version newer than 0.29.1 once a patched release is available
  • Restrict network access to Dokploy administrative interfaces to trusted administrative hosts only
  • Implement input validation and sanitization for all file upload destination paths, rejecting shell metacharacters
  • Review container runtime configurations to apply principle of least privilege for docker daemon access
  • Enable comprehensive audit logging for file upload operations and command execution events
  • Consider network segmentation to isolate Dokploy management plane from production workloads

Evidence notes

Vulnerability confirmed through GitHub Security Advisory GHSA-9m66-74x3-5mwr. CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H indicates network-accessible, low-complexity attack requiring low privileges with scope change and complete CIA impact. CWE-77 (Command Injection) classified as secondary weakness source. NVD status 'Deferred' suggests ongoing analysis.

Official resources

2026-05-29