CVE-2026-45629 Details

A command injection vulnerability allowing authenticated users to execute arbitrary system commands has been identified in Dokploy versions through 0.28.8. This issue resides in the '/listen-deployment' WebSocket endpoint, which streams deployment logs via SSH. The vulnerability arises because the 'logPath' parameter validation can be bypassed, enabling any organization member to execute commands on remote servers managed by Dokploy, potentially leading to full server compromise.

It is recommended to implement strict regex validation for the 'logPath' parameter to reject shell metacharacters before the path is processed. Alternatively, the path value can be base64-encoded to prevent shell interpretation, or SFTP streaming can be used to read files instead of executing commands via the shell.