EUVD-2026-55681Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable panel with low-complexity injection, but an authenticated config-editing account is required (PR:L); command execution on separate managed servers is a scope change (S:C) with full C/I/A impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed through execAsyncRemote. Single quotes in redirect regex and replacement fields, basic authentication usernames, domain host values, or middleware configuration can terminate the shell quoting and execute arbitrary commands on managed remote servers with the configured SSH user's privileges. This vulnerability is caused by an incomplete fix for CVE-2026-45630. This issue is fixed in version 0.29.13.
AnalysisAI
Command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated panel user run arbitrary commands on managed remote servers by embedding a single quote in Traefik configuration fields. The flaw sits in writeTraefikConfigRemote, which interpolates yaml.stringify output into an unsanitized 'echo '...' > file' shell command run over SSH via execAsyncRemote. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Dokploy account with privileges to edit Traefik-related configuration (redirect regex/replacement fields, basic-authentication usernames, domain host values, or middleware configuration) and a Dokploy instance that manages at least one remote server via SSH (the writeTraefikConfigRemote / execAsyncRemote path). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals align toward genuine priority for anyone running Dokploy that manages remote servers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged but authenticated Dokploy user (or an attacker who compromised such an account) edits an application's Traefik settings - for example the HTTPS redirect regex, a basic-auth username, or a domain host - and inserts a single quote followed by shell commands. When Dokploy regenerates the Traefik config, writeTraefikConfigRemote interpolates that value into an SSH-executed echo command, and the injected commands run on the managed remote server with the configured SSH user's privileges. … |
| Remediation | Upgrade to Dokploy 0.29.13, which is the vendor-released patch that replaces the vulnerable 'echo '<yaml>' > file' pattern with base64-encoded input decoded via 'base64 -d' and shell-quote quoting of paths (commit 92310ddb143c8e67ca95eb7db661838a76579f2e; release https://github.com/Dokploy/dokploy/releases/tag/v0.29.13). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all Dokploy deployments in production and their versions, restrict panel user access to essential administrators only, and audit recent Traefik configuration changes for anomalies. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Dokploy self-hosted PaaS prior to 0.26.6 has a critical command injection vulnerability (CVSS 9.9) allowing authenticate
Dokploy versions before 0.26.6 contain hardcoded database credentials in the installation script, causing nearly all dep
Command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated low-privilege member run arbitrary
Remote code execution in Dokploy 0.27.0 through 0.29.2 allows unauthenticated attackers to forge email-verification JWTs
Command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user run arbitrary OS commands on
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Command injection in Dokploy self-hosted PaaS versions prior to 0.29.13 lets an authenticated user with database-service
OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets a low-privileged team member with service-deploym
Command injection in Dokploy self-hosted PaaS before 0.29.13 lets a low-privileged organization member run arbitrary OS
OS command injection in Dokploy (self-hosted PaaS) version 0.28.8 and earlier lets an authenticated user with permission
OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated user with the backup:restore per
OS command injection in Dokploy self-hosted PaaS prior to 0.29.13 lets an authenticated project member with compose writ
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today