CVE-2026-93425 Details
Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe argument quoting. An authenticated organization member with service:read permission can inject shell metacharacters into repoPath and execute arbitrary commands through child_process.exec as root in the Dokploy container. The supplied service identifier is used only to resolve the server and does not constrain repoPath. Because the standard deployment mounts /var/run/docker.sock, container-root command execution can be used to control Docker and compromise the host and its managed applications. This issue is fixed in version 0.29.13.
A command injection vulnerability has been identified in Dokploy versions prior to 0.29.13. The issue arises in the patch.readRepoDirectories tRPC procedure, where the user-controlled repoPath parameter is passed into a shell command without proper sanitization. This vulnerability allows an authenticated organization member with service:read permission to inject arbitrary commands that are executed as root within the Dokploy container. The exploitation of this vulnerability is particularly concerning because the container has access to the host's Docker socket, enabling a full compromise of the host and its managed applications.
Users can update to Dokploy version 0.29.13 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Dokploy/dokploy/security/advisories/GHSA-56g6-wjr4-5q7p | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Dokploy/dokploy/commit/16b5b7293f9883327a89c69fcb6e5718767b064a | [email protected] | Source CodeVendor |
| https://github.com/Dokploy/dokploy/releases/tag/v0.29.13 | [email protected] | Release NotesVendor |
| https://github.com/Dokploy/dokploy/security/advisories/GHSA-56g6-wjr4-5q7p | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Dokploy | <= 0.29.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 24, 2026 | New CVE Received | [email protected] |