Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
60 results · page 1 of 2
Oct 25, 2026Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications bCVE-2026-116068 · Other software · Dokploy · reported by VulnCheckHigh 8.7
Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to overwrite environment variables and build secrets, repoint sources, and disrupt other tenants' applications.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated owners or admins of any organizationCVE-2026-111331 · Other software · Dokploy · reported by VulnCheckMedium 5.3
Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated owners or admins of any organization to manage other tenants' ports because the target application's organization is never verified. Attackers supplying a known portId or applicationId to port.create, port.one, port.update, or port.delete can read, modify, delete, or add port mappings, disrupting how victim services are published.
- Product
- Dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-93425 · Other software · Dokploy · reported by GitHubCritical 9.9
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe argument quoting. An authenticated organization member with service:read permission can inject shell metacharacters into repoPath and execute arbitrary commands through child_process.exec as root in the Dokploy container. The supplied service identifier is used only to resolve the server and does not constrain repoPath. Because the standard deployment mounts /var/run/docker.sock, container-root command execution can be used to control Docker and compromise the host and its managed applications. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-86059 · Other software · Dokploy · reported by GitHubCritical 9.6
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy organization members without Git provider access can retrieve plaintext provider credentials through github.one, gitlab.one, gitea.one, and bitbucket.one because those protected procedures return full provider rows without applying getAccessibleGitProviderIds or an organization check. The application.one route also returns nested GitHub, GitLab, Gitea, and Bitbucket relations from findApplicationById with GitHub App private keys, OAuth tokens, client secrets, webhook secrets, and app passwords even when hasGitProviderAccess is false. A member with application read access or a provider identifier can therefore bypass per-member provider assignment and use the exposed credentials to access private repositories or manipulate external workflows. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026A vulnerability was detected in Dokploy up to 0.29.7.CVE-2026-82954 · Other software · reported by VulDBHigh 8.6
A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the function writeTraefikConfigInPath of the file packages/server/src/utils/traefik/application.ts of the component Settings. The manipulation of the argument path results in path traversal. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-45791 · Other software · Dokploy · reported by GitHubMedium 5.9
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.session_token session to remain valid for up to three days after a password change. This issue is fixed in version 0.29.6.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-45790 · Other software · Dokploy · reported by GitHubHigh 8
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.ts allows a user with member:create permission to invite an account with the owner role, while packages/server/src/services/user.ts allows a privileged self-hosted user to create an account with an arbitrary role, enabling permanent organization takeover because owner roles cannot be demoted. This issue is fixed in version 0.29.6.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72902 · Other software · Dokploy · reported by GitHubCritical 9.9
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server because registry.testRegistry and registry.testRegistryById in apps/dokploy/server/api/routers/registry.ts interpolate the password field into an execAsyncRemote shell command instead of using safeDockerLoginCommand. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72901 · Other software · Dokploy · reported by GitHubCritical 9.9
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated low-privilege member to execute arbitrary commands on the control-plane host because the volumeName field accepted by volumeBackup.create and volumeBackup.runManually is interpolated without quoting in packages/server/src/utils/volume-backups/backup.ts and executed through child_process.exec, with Docker socket access making execution host/root-equivalent. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72886 · Other software · Dokploy · reported by GitHubCritical 9.9
Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.2 until 0.29.13, schedule.create and schedule.update in apps/dokploy/server/api/routers/schedule.ts derive serviceId from applicationId or composeId and execute the owner/admin host-schedule gate only in the alternative branch, allowing a member with access to one application to attach its applicationId to a dokploy-server schedule and run a supplied script as root through schedule.runManually. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72885 · Other software · Dokploy · reported by GitHubNone
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, dockerContextPath accepted by apps/dokploy/components/dashboard/application/build/show.tsx flows through getDockerContextPath in packages/server/src/utils/filesystem/directory.ts into the unquoted cd command in packages/server/src/utils/builders/docker-file.ts before execution by execAsync, allowing an authenticated application editor to execute arbitrary commands on the Dokploy host. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72884 · Other software · Dokploy · reported by GitHubHigh 8.7
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, sanitizeCommand in packages/server/src/utils/builders/compose.ts only trims whitespace and strips surrounding quotes from compose.command before exportEnvCommand and docker command interpolation, allowing an authenticated user who can update a Compose service to inject shell metacharacters and execute arbitrary commands on the Dokploy host. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72883 · Other software · Dokploy · reported by GitHubHigh 8.8
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the WebSocket handlers in apps/dokploy/server/wss/terminal.ts, apps/dokploy/server/wss/docker-container-terminal.ts, apps/dokploy/server/wss/docker-container-logs.ts, and apps/dokploy/server/wss/docker-stats.ts validate organization membership but do not enforce checkServiceAccess, accessedServerIds, or accessedServices, allowing an authenticated organization member to obtain root terminal access and read logs or statistics for restricted servers and services. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72882 · Other software · Dokploy · reported by GitHubCritical 9.9
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, an authenticated user who can create or update file mounts for a service can inject shell metacharacters into filePath, causing Dokploy to execute attacker-controlled commands on the configured remote managed server over SSH. In the default deployment model, this yields direct remote host RCE from the web interface.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72881 · Other software · Dokploy · reported by GitHubMedium 6.4
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, database backup and restore command builders in packages/server/src/utils/backups/utils.ts and packages/server/src/utils/restore/utils.ts interpolate database names, usernames, and passwords into nested shell command strings passed to child_process.exec(). An authenticated administrator with permission to create databases and configure backups can use crafted database configuration fields to execute arbitrary commands inside PostgreSQL, MariaDB, MySQL, MongoDB, or LibSQL containers, exposing database data and credentials and potentially enabling escape when a container is overprivileged. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72880 · Other software · Dokploy · reported by GitHubCritical 9.9
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the apiCreateCertificate schema in packages/server/src/db/schema/certificate.ts accepts a client-supplied certificatePath, and packages/server/src/services/certificate.ts joins that value to the certificate root without confinement. An authenticated user with certificate create or delete permission can use certificatePath to write attacker-controlled certificate content outside the intended directory or delete an out-of-root directory. This vulnerability is fixed in 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72879 · Other software · Dokploy · reported by GitHubCritical 9.4
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.8, the getRegistryCommands() function in packages/server/src/utils/cluster/upload.ts interpolates registry.password and registry.registryUrl directly into a shell command without escaping. An authenticated user with project access can configure malicious registry credentials and trigger a swarm deployment to execute arbitrary OS commands on the Dokploy server, read or modify host files, and access other containers through Docker. This issue is fixed in version 0.29.8.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72878 · Other software · Dokploy · reported by GitHubCritical 9.6
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy's backup and restore pipeline constructs shell commands by directly interpolating user-controlled database fields into bash -c "..." and sh -c "..." strings, then executes them via child_process.exec(). An authenticated admin/owner can inject arbitrary OS commands that execute on the host machine running Dokploy (not just inside a container). This vulnerability is fixed in 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72877 · Other software · Dokploy · reported by GitHubCritical 9.6
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the dockerImage field is interpolated without quoting into shell commands in buildRemoteDocker() in packages/server/src/utils/providers/docker.ts and is validated only as an optional string. An authenticated user with application create or update permission can use shell command substitution in dockerImage to execute arbitrary commands on the local build host or a remote SSH build target, exposing host secrets and other projects. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72876 · Other software · Dokploy · reported by GitHubCritical 9.9
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, and swarm.getAppInfos in apps/dokploy/server/api/routers/swarm.ts accept another organization’s serverId without an activeOrganizationId ownership check, and getNodeInfo in packages/server/src/services/docker.ts interpolates nodeId into execAsyncRemote, allowing a caller with server:read permission to execute arbitrary commands as the configured SSH user on another tenant’s server. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72875 · Other software · Dokploy · reported by GitHubHigh 8.8
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, settings.readTraefikFile in apps/dokploy/server/api/routers/settings.ts passes a path accepted by apiReadTraefikConfig to readConfigInPath in packages/server/src/utils/traefik/application.ts, where configPath is interpolated into execAsyncRemote as cat ${configPath}, allowing a user with traefikFiles.read permission to execute arbitrary commands on a managed server through shell metacharacters. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72874 · Other software · Dokploy · reported by GitHubHigh 8.7
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, cloneGitRepository in packages/server/src/utils/providers/git.ts interpolates customGitUrl and customGitBranch into a git clone command passed to execAsync or execAsyncRemote, allowing an authenticated user with application access to execute arbitrary operating system commands on the Dokploy host by setting a malicious custom Git URL and triggering deployment. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72873 · Other software · Dokploy · reported by GitHubMedium 6.5
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, application.one in apps/dokploy/server/api/routers/application.ts returns provider relations loaded by findApplicationById in packages/server/src/services/application.ts without redacting githubClientSecret, githubPrivateKey, or githubWebhookSecret, allowing a user with only service:read permission to retrieve another user’s Git provider secrets even when hasGitProviderAccess is false and unauthorizedProvider is set. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72872 · Other software · Dokploy · reported by GitHubCritical 9.9
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, application.saveBitbucketProvider stores bitbucketOwner and bitbucketRepository without validation and cloneBitbucketRepository in packages/server/src/utils/providers/bitbucket.ts interpolates those values into git clone commands executed through execAsync or execAsyncRemote, allowing a member with service deployment permission to execute arbitrary operating system commands on the Dokploy host or target server. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72871 · Other software · Dokploy · reported by GitHubHigh 7.5
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the unauthenticated /api/providers/github/setup route in apps/dokploy/pages/api/providers/github/setup.ts trusts gh_init organizationId and userId values from the state parameter and calls createGithub in packages/server/src/services/github.ts, allowing an attacker to insert a GitHub App provider containing client_secret, webhook_secret, and PEM private key material into another organization. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72870 · Other software · Dokploy · reported by GitHubHigh 8.7
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the buildRemoteDocker() function in packages/server/src/utils/providers/docker.ts interpolates the application-controlled dockerImage value directly into a docker pull shell command. An authenticated user with project access can set a crafted dockerImage through application.update and trigger application.deploy, causing execAsync() to execute arbitrary operating-system commands as the Dokploy server process. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72869 · Other software · Dokploy · reported by GitHubCritical 9.9
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription passes the databaseName parameter to restore builders in packages/server/src/utils/restore/utils.ts, where PostgreSQL, MariaDB, MySQL, and MongoDB commands embed the value in nested shell text executed by Node.js exec. An authenticated user with backup:restore permission can supply a crafted databaseName that the host /bin/sh expands before docker exec, resulting in arbitrary commands running in the Docker-privileged host context. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72868 · Other software · Dokploy · reported by GitHubCritical 9.9
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, apps/dokploy/server/api/routers/destination.ts interpolates the accessKey, secretAccessKey, region, endpoint, provider, and bucket fields from destination.testConnection into an rclone ls command executed through child_process.exec. The `withPermission("destination", "create")` path permits a low-privileged organization member to reach the mutation, close a quoted argument with a crafted field, and execute arbitrary commands in the root Dokploy container, which has access to the host Docker socket. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72867 · Other software · Dokploy · reported by GitHubCritical 9.9
Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch, branch, gitlabBranch, bitbucketBranch, or giteaBranch. A low-privileged authenticated user can trigger compose.deploy, which passes the stored branch to shell-based Git clone commands in packages/server/src/utils/providers/git.ts, github.ts, gitlab.ts, bitbucket.ts, and gitea.ts, resulting in arbitrary host command execution. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72866 · Other software · Dokploy · reported by GitHubHigh 8.8
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the WebSocket handler in apps/dokploy/server/wss/terminal.ts validates a session but does not authorize access to the requested server. An authenticated user can connect to /terminal?serverId=local, select the special serverId=local branch, and obtain an interactive terminal on the Dokploy host without an organization role or server-access check. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72865 · Other software · Dokploy · reported by GitHubCritical 9.9
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the compose.update operation stores an unvalidated composePath that packages/server/src/utils/builders/compose.ts and packages/server/src/services/compose.ts interpolate into docker compose -f, docker stack deploy -c, and touch shell commands executed through /bin/sh -c. An authenticated member with compose write and deploy permission can supply a crafted composePath, trigger compose.deploy or startCompose, and execute arbitrary operating-system commands in the Docker-privileged Dokploy host context. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72864 · Other software · Dokploy · reported by GitHubCritical 9.9
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the local branch of /docker-container-terminal in apps/dokploy/server/wss/docker-container-terminal.ts authenticates with validateRequest but does not authorize the attacker-controlled containerId against the caller's role, organization, or service access before passing it to `docker exec`, allowing any authenticated member to obtain a root shell in arbitrary containers on a self-hosted instance. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72863 · Other software · Dokploy · reported by GitHubCritical 9.9
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy's WebSocket handlers (in-app terminals and log streamers) authenticate the session but never authorize it. They establish who the user is via validateRequest() and then proceed without consulting the role/permission model that every tRPC procedure enforces. Any authenticated member, can therefore open an interactive shell into any container on the host, including the dokploy container that mounts the Docker socket, and from there obtain root on the host, escaping the application and crossing every tenant boundary. This vulnerability is fixed in 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72862 · Other software · Dokploy · reported by GitHubCritical 9.9
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts Dokploy database service deployment functions pass user-controlled dockerImage fields unquoted into docker pull ${dockerImage} shell commands on the remote-server code path. This vulnerability is fixed in 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72740 · Other software · Dokploy · reported by GitHubCritical 9.9
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, packages/server/src/utils/providers/git.ts parses the user-controlled customGitUrl with sanitizeRepoPathSSH and interpolates its domain into the ssh-keyscan command from addHostToKnownHostsCommand without shell quoting, allowing an authenticated member with service deployment permission and an attached SSH key to execute arbitrary commands on the Dokploy host during deployment. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72739 · Other software · Dokploy · reported by GitHubMedium 6.5
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the createCommand() function constructs shell commands by interpolating compose service names and configuration into bash command strings. When a compose with a maliciously crafted name or service definition is deployed, the shell metacharacters are interpreted as command separators, allowing arbitrary command execution on the Docker host. This vulnerability is fixed in 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72738 · Other software · Dokploy · reported by GitHubCritical 9.9
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.listBackupFiles tRPC endpoint in apps/dokploy/server/api/routers/backup.ts passes the search parameter through normalizeS3Path and interpolates it into an rclone lsjson command executed by child_process.exec(), allowing an authenticated user with backup:read permission to execute arbitrary commands on the Dokploy host. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72737 · Other software · Dokploy · reported by GitHubCritical 9.6
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.8 and earlier, backup.create, backup.update, and backup.restoreBackupWithLogs in apps/dokploy/server/api/routers/backup.ts accept a client-controlled destinationId and use the referenced destination without verifying that destination.organizationId equals ctx.session.activeOrganizationId. An authenticated member with backup permissions for a service in one organization can cause another organization's S3 accessKey and secretAccessKey to be materialized by packages/server/src/utils/backups/utils.ts getS3Credentials on the attacker's service host, read that organization's backup objects, or redirect and poison backups across tenant boundaries.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72736 · Other software · Dokploy · reported by GitHubCritical 9.9
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy passes user-controlled values directly into shell commands via unquoted template literal interpolation in the registry credential testing and Docker Swarm cluster management endbpoints. Both endpoints have a safe local code path (using execFileAsync or the Docker API) but a vulnerable remote path (using execAsyncRemote which runs the shell string via SSH). This vulnerability is fixed in 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72735 · Other software · Dokploy · reported by GitHubCritical 9.9
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed through execAsyncRemote. Single quotes in redirect regex and replacement fields, basic authentication usernames, domain host values, or middleware configuration can terminate the shell quoting and execute arbitrary commands on managed remote servers with the configured SSH user's privileges. This vulnerability is caused by an incomplete fix for CVE-2026-45630. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72734 · Other software · Dokploy · reported by GitHubHigh 8.4
Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.28.7 until 0.29.13, the server.remove tRPC mutation in apps/dokploy/server/api/routers/server.ts accepts a caller-controlled serverId and calls haveActiveServices, findServerById, removeDeploymentsByServerId, and deleteServer without verifying that currentServer.organizationId equals ctx.session.activeOrganizationId. An authenticated owner or administrator with server:delete in one organization who previously observed another organization's serverId can delete that organization's server registration and deployment records, interrupt Dokploy management, and receive the associated plaintext SSH private key even though server.one denies the same cross-organization read. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-72733 · Other software · Dokploy · reported by GitHubCritical 9.9
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds database restore shell pipelines from the user-controlled databaseName and backupFile fields without safely separating them from shell syntax. packages/server/src/utils/restore/utils.ts interpolates databaseName into database-specific restore commands, while packages/server/src/utils/restore/postgres.ts and the analogous restore modules interpolate backupFile into rclone paths. An authenticated member with backup-restore permission can inject operating-system commands that execute in the Dokploy host context through execAsync or execAsyncRemote, even when no valid database container or backup file exists. This issue is fixed in version 0.29.13.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-45661 · Other software · Dokploy · reported by GitHubCritical 9.9
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.5 and earlier, a critical path traversal vulnerability exists in Dokploy v0.26.5 that allows authenticated users to write arbitrary files to the filesystem during application deployment. When combined with Dokploy's remote server deployment feature, this vulnerability enables arbitrary file write to remote server filesystems, automatic remote code execution via cron jobs, complete server compromise, data exfiltration without user interaction, and persistent backdoor installation. This vulnerability bypasses all container isolation on remote server deployments.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-45633 · Other software · Dokploy · reported by GitHubCritical 9.9
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.6 and earlier, Dokploy contains a command injection vulnerability in the /docker-container-logs WebSocket endpoint. The tail and since parameters are not validated and are directly concatenated into shell commands, allowing authenticated users to execute arbitrary commands with root privileges.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-45632 · Other software · Dokploy · reported by GitHubCritical 9.9
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.7 and earlier, the schedule router does not enforce organization/role checks. As a result, any authenticated user can create, update, run, or delete schedules belonging to other organizations if they know the scheduleId/serverId. Schedule types server and dokploy-server write and execute scripts on the host or remote servers, enabling RCE on the Dokploy host or a target server.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-45631 · Other software · Dokploy · reported by GitHubCritical 10
Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.27.0 to before 0.29.3, a hardcoded BETTER_AUTH_SECRET fallback ("better-auth-secret-123456789") lets an unauthenticated attacker forge email verification JWTs, trigger auto-sign-in as admin, and execute commands on the host via the built-in SSH terminal. This vulnerability is fixed in 0.29.3.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-45630 · Other software · Dokploy · reported by GitHubCritical 9
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, authenticated OS command injection in the application.updateTraefikConfig tRPC endpoint allows admin/owner users to execute arbitrary system commands on remote servers via unsanitized echo shell interpolation.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-45629 · Other software · Dokploy · reported by GitHubCritical 9.9
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, authenticated OS command injection in the /listen-deployment WebSocket endpoint allows any organization member to execute arbitrary system commands on remote servers managed by Dokploy, leading to full server compromise.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-45628 · Other software · Dokploy · reported by GitHubCritical 9.6
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.2 and earlier, Dokploy constructs shell commands using JavaScript template literals and executes them via child_process.exec() (which runs through /bin/sh -c). User-supplied branch names, repository URLs, and Docker credentials are interpolated directly into these commands without escaping. This requires an authenticated user with application create/edit privileges.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026Dokploy is a free, self-hostable Platform as a Service (PaaS).CVE-2026-43917 · Other software · Dokploy · reported by GitHubMedium 5.3
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.19.0 and earlier, the protectedProcedure middleware only verifies the user is authenticated - it does NOT enforce organization scoping. Each endpoint must individually verify the resource's org matches the session's activeOrganizationId. This affects the following endpoints: allByType, killProcess, and removeDeployment in deployment.ts; delete in rollbacks.ts; create, one, update, remove, manualBackupPostgres, MySql, Mariadb, Mongo, Compose, WebServer, and listBackupFiles in backup.ts; list, one, delete, update, runManually, and restoreVolumeBackupWithLogs in volume-backups.ts; getNodes, removeWorker, addWorker, and addManager in cluster.ts; and create in mount.ts.
- Product
- dokploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.