CVE Feed

    Dashboard / CVE / CVE-2026-45633

    CVE-2026-45633

    Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.6 and earlier, Dokploy contains a command injection vulnerability in the /docker-container-logs WebSocket endpoint. The tail and since parameters are not validated and are directly concatenated into shell commands, allowing authenticated users to execute arbitrary commands with root privileges.

    Published:May 29, 2026
    Last Modified:May 29, 2026
    EPS:May 29, 2026
    EPSS Score:
    CVSS Score:9.9

    Affected Products

    Vendor
    Dokploy
    Product
    Dokploy

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-82954 (CVSS 8.6) — A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the function writeTraefikConfigInPath…
    CVE-2026-45791 (CVSS 5.9) — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's user.update procedur…
    CVE-2026-45790 (CVSS 8) — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's organization.inviteM…
    CVE-2026-72902 (CVSS 9.9) — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticat…
    CVE-2026-72901 (CVSS 9.9) — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticat…
    CVE-2026-72886 (CVSS 9.9) — Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.2 until 0.29.13, schedule.create and …
    CVE-2026-72885 (CVSS 0) — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, dockerContextPath accepted by…
    CVE-2026-72884 (CVSS 8.7) — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, sanitizeCommand in packages/s…
    CVE-2026-72883 (CVSS 8.8) — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the WebSocket handlers in app…
    CVE-2026-72882 (CVSS 9.9) — Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, an authenticated user wh…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High