EUVD-2026-33353CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.6 and earlier, Dokploy contains a command injection vulnerability in the /docker-container-logs WebSocket endpoint. The tail and since parameters are not validated and are directly concatenated into shell commands, allowing authenticated users to execute arbitrary commands with root privileges.
AnalysisAI
Authenticated command injection in Dokploy 0.26.6 and earlier enables any logged-in user to run arbitrary OS commands as root via the /docker-container-logs WebSocket endpoint. The tail and since parameters are concatenated into shell commands without validation, yielding a CVSS 9.9 (Scope:Changed) issue affecting this self-hosted PaaS. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
24 hours: Restrict network access to /docker-container-logs WebSocket endpoint via firewall; audit and validate all active user sessions; enable MFA on all accounts. 7 days: Implement WAF or firewall rules blocking shell command injection patterns in WebSocket parameters; establish continuous monitoring for WebSocket-based exploitation attempts; identify all affected Dokploy instances and document versions in deployment inventory. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today