CVE-2026-45663 Details
Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.1 and earlier, a command injection vulnerability exists in the Docker file upload functionality. When an authenticated user uploads a file to a container, the destinationPath parameter is not properly sanitized and is directly interpolated into a shell command string. By including shell metacharacters such as ; or ", an attacker can escape the intended docker cp command and execute arbitrary OS commands on the Dokploy host.
A command injection vulnerability allowing remote code execution has been identified in Dokploy versions through 0.29.1. The issue arises in the Docker file upload feature, where the destinationPath parameter is not properly sanitized. This flaw allows authenticated users to interpolate shell metacharacters into a command string, escaping the intended docker cp command and executing arbitrary operating system commands on the Dokploy host.
To address this vulnerability, it is recommended to validate the destinationPath parameter against a strict regular expression that disallows shell metacharacters. Additionally, use execFile or spawn with an array of arguments instead of string interpolation with exec, to prevent command injection.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 29, 2026CISA-ADP
Assessed May 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Dokploy/dokploy/security/advisories/GHSA-9m66-74x3-5mwr | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Dokploy/dokploy/security/advisories/GHSA-9m66-74x3-5mwr | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Dokploy | <= 0.29.1 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 29, 2026 | CVE Modified | CISA-ADP |
| May 29, 2026 | New CVE Received | [email protected] |