by Kastro
Paper/Archive/CVE-2026-45628

CVE-2026-45628

Dokploy dokploy — Dokploy: Command Injection via Unescaped Branch Fields in Deployment Pipeline

EPSS 0.2%CVSS 9.6
critical.is priorityof 100
32
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 13.8.138 × 202.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.2 and earlier, Dokploy constructs shell commands using JavaScript template literals and executes them via child_process.exec() (which runs through /bin/sh -c). User-supplied branch names, repository URLs, and Docker credentials are interpolated directly into these commands without escaping. This requires an authenticated user with application create/edit privileges.

Affected

ProductAffectedFixed inSource
dokploy<= 0.29.2–CNA

Scores by source

GitHub_M (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/Dokploy/dokploy/security/advisories/GHSA-3frc-cfh9-ch2c