UpHeron
All vulnerabilities

Servers and applications

CVE-2025-53376

An authenticated, low-privileged user without belonging to any organisation can run arbitrary OS commands on the Dokploy host.

Severity
Medium 6.3
Published
5 Jul 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
0.23.6, 0.23.7
Also known as
GHSA-m486-7pmj-8cmv
Sources
NVD, Project advisories (GitHub)

Description

Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated, low-privileged user can run arbitrary OS commands on the Dokploy host. The tRPC procedure docker.getContainersByAppNameMatch interpolates the attacker-supplied appName value into a Docker CLI call without sanitisation, enabling command injection…

Affected software

SoftwareAffected versions
DokployServers and applications · cpe:a:dokploy:dokploy
  • Every version before 0.23.7
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.23.6

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-53376
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-53376
  • GitHub Advisory Database https://github.com/advisories/GHSA-m486-7pmj-8cmv
  • github.com https://github.com/Dokploy/dokploy/security/advisories/GHSA-m486-7pmj-8cmv