All vulnerabilities
CVE-2026-93425GHSA-56g6-wjr4-5q7p

Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root

Dokploy dokploy
Open in ThreatlineRecord JSON
CVSS
9.9Critical
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 24 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.62%Chance of exploitation activity in the next 30 days, higher than 48% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published24 Sep 2026Updated 24 Sep 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe argument quoting. An authenticated organization member with service:read permission can inject shell metacharacters into repoPath and execute arbitrary commands through child_process.exec as root in the Dokploy container. The supplied service identifier is used only to resolve the server and does not constrain repoPath. Because the standard deployment mounts /var/run/docker.sock, container-root command execution can be used to control Docker and compromise the host and its managed applications. This issue is fixed in version 0.29.13.

Text from CVE List

Affected versions 2

  • dokployaffected: < 0.29.13CVE List
  • dokploy/dokploy, docker / self-hosted (dokploy/dokploy)<= 0.29.8GitHub

References 3