What is the CVSS score of CVE-2026-45661?

CVE-2026-45661 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Dokploy are affected by CVE-2026-45661?

Dokploy v0.26.5 and earlier contain a critical path traversal vulnerability that allows authenticated users with deployment privileges to write arbitrary files and execute code on remote servers,…

How to fix or mitigate CVE-2026-45661?

Within 24 hours: Disable remote server deployment feature or restrict deployment role access to essential personnel only. Within 7 days: Audit all accounts with deployment privileges, review deployment activity logs for suspicious changes, and confirm Dokploy version across all instances. Within 30 days: Monitor Dokploy security advisories (GHSA-66v7-g3fh-47h3) for patch release and plan upgrade immediately upon availability.

Dokploy CVE-2026-45661

EUVD-2026-33352 CRITICAL

Path Traversal (CWE-22)

2026-05-29 GitHub_M

RCE Path Traversal Dokploy

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 17:52 vuln.today

DescriptionCVE.org

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.5 and earlier, a critical path traversal vulnerability exists in Dokploy v0.26.5 that allows authenticated users to write arbitrary files to the filesystem during application deployment. When combined with Dokploy's remote server deployment feature, this vulnerability enables arbitrary file write to remote server filesystems, automatic remote code execution via cron jobs, complete server compromise, data exfiltration without user interaction, and persistent backdoor installation. This vulnerability bypasses all container isolation on remote server deployments.

AnalysisAI

Authenticated path traversal in Dokploy v0.26.5 and earlier (CWE-22) enables arbitrary file write during application deployment, escalating to remote code execution when the affected instance uses the remote server deployment feature. With a CVSS 9.9 score reflecting scope change and full CIA impact, any user with deployment privileges can drop cron jobs onto remote hosts to fully compromise them, bypassing container isolation. No public exploit identified at time of analysis, though the vendor's own GHSA-66v7-g3fh-47h3 advisory characterizes the chain as critical.

Technical ContextAI

Dokploy is a self-hostable Platform-as-a-Service that orchestrates application builds and deployments across one or more target hosts, including a remote server deployment mode that pushes built artifacts to non-local machines. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): file paths supplied during the deployment workflow are not properly normalized or constrained to an intended base directory, so traversal sequences escape the intended deployment sandbox. Because deployment runs with the privileges of the Dokploy worker and writes outside container boundaries on remote targets, attacker-controlled files can land in directories such as cron spool locations, turning a file-write primitive into automatic code execution. The affected CPE is cpe:2.3:a:dokploy:dokploy:*:*:*:*:*:*:*:* with no upper-bound version, covering all releases through 0.26.5.

RemediationAI

Upgrade to a Dokploy release later than 0.26.5 as published in the vendor advisory at https://github.com/Dokploy/dokploy/security/advisories/GHSA-66v7-g3fh-47h3; the input data does not include a specific patched version number, so administrators should pull the fix version cited in that GHSA rather than relying on a number invented here (patch available per vendor advisory). If immediate upgrade is not possible, reduce blast radius by disabling or restricting the remote server deployment feature to remove the cross-host file-write path, tightening Dokploy account provisioning so only fully trusted operators hold deployment privileges (this is what PR:L effectively gates), and placing the Dokploy admin interface behind VPN or IP allowlists to shrink the attacker population; the trade-off is loss of self-service deployments and reduced multi-tenant usability until the patched build is rolled out. Audit cron directories and deployment target filesystems on remote servers for unexpected files written prior to remediation, since the vulnerability supports persistent backdoor installation.