UpHeron
All posts

Critical vulnerabilities

25 critical vulnerabilities in Dokploy

25 vulnerabilities rated critical (CVSS 9.0 or higher) found on 12 November 2026: Dokploy (25).

  • 25 critical

Dokploy

25 vulnerabilities · Servers and applications · most fixed in 0.31.1

  1. 9.9Non-admin organisation member can gain root on the host via an unrestricted host bind-mountFixed in 0.31.1GHSA-jrg5-2gj5-h827
  2. 9.9Cross-organization IDOR across ~145 tRPC handlers via checkServicePermissionAndAccess / checkServiceAccess owner/admin bypass (CVE-2026-43917 missed siblings)…Fixed in 0.31.1GHSA-fx4f-j8fj-2q69
  3. 9.9Authenticated OS command injection in Dokploy leads to root remote code execution (systemic; multiple endpoints)Fixed in 0.31.1GHSA-5cvm-v3wv-2gw3
  4. 9.9Authenticated OS command injection in database backup/restore → root RCE (v0.29.8)Fixed in 0.31.1GHSA-qh9m-682j-9fqr
  5. 9.9Authenticated Remote Code Execution and Host Escape via Command Injection in Dokploy Domain Management ServiceName FieldFixed in 0.30.0GHSA-xmmr-fhf3-cwwj
Show 20 more
  1. 9.9Path Traversal + Command Injection in Patch Application (`generateApplyPatchesCommand`)Fixed in 0.31.1GHSA-phrr-h3mm-9vp6
  2. 9.9[CWE-78] Authenticated Shell Command Injection via Patch Repository Path in DokployFixed in 0.31.1GHSA-h542-rh5v-qgj2
  3. 9.9Authenticated Command Injection via unescaped backup.prefix in database/service backup commands leads to RCE as rootFixed in 0.31.1GHSA-2gq3-9q77-8hgv
  4. 9.9OS Command Injection via serviceName in Compose BackupFixed in 0.31.1GHSA-j329-jw7j-rxjm
  5. 9.9Authenticated Path Traversal in 'mounts.create' 'filePath' leads to Arbitrary Root-Owned File Write on Host via Bind MountFixed in 0.31.1GHSA-5mqv-h2xh-fvhg
  6. 9.9OS Command Injection via filePath in mount.deleteFileMount → HOST RCEFixed in 0.31.1GHSA-945r-hp2m-928m
  7. 9.9OS Command Injection via composePath remains in utils/docker/domain.ts - incomplete fix of CVE-2026-72865Fixed in 0.31.1GHSA-x2r4-3gv4-jv6x
  8. 9.9docker-container-terminal serviceId gate not bound to containerId (incomplete fix of CVE-2026-72864) - member with one service opens root shell in any org…Fixed in 0.31.0GHSA-86jc-q5q3-78vv
  9. 9.9Systemic Cross-Organization IDOR via Shared Permission Helpers, Affecting Credentials, Domains, File Mounts, and Database PasswordsFixed in 0.31.1GHSA-9889-w3j8-rm22
  10. 9.9Cross-organization project takeover via `project.update`Fixed in 0.31.1GHSA-h52x-gwf8-4h58
  11. 9.9Incomplete fix of GHSA-p2c7-8j28-c7gq + Missing Authorization in backup/restore (Member -> command execution on managed servers, instance exfiltration and…Fixed in 0.31.1GHSA-2w53-7ppr-3xpp
  12. 9.9`ai.deploy` does not validate serverId - members can deploy to other organizations' serversFixed in 0.31.1GHSA-8rch-pggc-942j
  13. 9.6Traefik rule injection via unsanitized host and path fields — cross-tenant traffic hijackFixed in 0.31.1GHSA-5qmc-4xhw-j6vp
  14. 9.1Dokploy Drop deployment ZIP traversal can overwrite global Traefik dynamic routing configurationFixed in 0.31.1GHSA-h8q2-p3w4-m3mr
  15. 9.1OS command injection via libsql appName missing APP_NAME_REGEX validationFixed in 0.31.0GHSA-x3g8-6v8j-rm56
  16. 9.1Path traversal in `appName` on the `/listen-docker-stats-monitoring` WebSocket lets a low-privileged member create arbitrary directories and write files as…Fixed in 0.31.1GHSA-87rx-r765-9c93
  17. CriticalIncomplete fix of GHSA-899j-cjwp-v4gw: serviceId lets a member reach any container (Member -> Root) over the docker WebSocket handlersUp to 0.30.8GHSA-pwg8-2x8c-wc2m
  18. CriticalPath Traversal & RCE via unzipDrop and SchedulesFixed in 0.31.1GHSA-wcp5-g62q-jfr9
  19. CriticalRCE via Command Injection in Schedule appNameFixed in 0.31.1GHSA-8m32-h7qx-8r79
  20. CriticalCross-organization SSH key attachment in Dokploy server updateFixed in 0.31.1GHSA-v2pj-9x4j-7hcj

From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.