EUVD-2026-55740Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable API, low-privilege authenticated account required (traefikFiles.read), no user interaction, full RCE impact on managed servers within Dokploy's administrative domain.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, settings.readTraefikFile in apps/dokploy/server/api/routers/settings.ts passes a path accepted by apiReadTraefikConfig to readConfigInPath in packages/server/src/utils/traefik/application.ts, where configPath is interpolated into execAsyncRemote as cat ${configPath}, allowing a user with traefikFiles.read permission to execute arbitrary commands on a managed server through shell metacharacters. This issue is fixed in version 0.29.13.
AnalysisAI
Command injection in Dokploy's Traefik configuration reader allows authenticated users holding the traefikFiles.read permission to execute arbitrary OS commands on managed servers by supplying file paths containing shell metacharacters. All Dokploy releases prior to 0.29.13 are affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Dokploy user account with the traefikFiles.read permission explicitly granted - unauthenticated external attackers cannot exploit this directly. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a high-severity but permission-gated vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a legitimate Dokploy account holding the traefikFiles.read permission submits a crafted API request to the settings.readTraefikFile endpoint with a configPath value such as /etc/traefik/config.yml; id > /tmp/pwned #. Dokploy interpolates this into the shell command cat /etc/traefik/config.yml; id > /tmp/pwned #, which execAsyncRemote executes on the managed remote server, writing the server's user identity to a file. … |
| Remediation | Upgrade Dokploy to version 0.29.13 or later immediately, as documented in security advisory GHSA-j3pv-r5wg-235m and release tag https://github.com/Dokploy/dokploy/releases/tag/v0.29.13. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all Dokploy deployments to identify installations running versions prior to 0.29.13, and immediately restrict the traefikFiles.read permission to only essential trusted administrators; revoke access from all other accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Dokploy self-hosted PaaS prior to 0.26.6 has a critical command injection vulnerability (CVSS 9.9) allowing authenticate
Dokploy versions before 0.26.6 contain hardcoded database credentials in the installation script, causing nearly all dep
Command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated low-privilege member run arbitrary
Remote code execution in Dokploy 0.27.0 through 0.29.2 allows unauthenticated attackers to forge email-verification JWTs
Command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user run arbitrary OS commands on
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Command injection in Dokploy self-hosted PaaS versions prior to 0.29.13 lets an authenticated user with database-service
OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets a low-privileged team member with service-deploym
Command injection in Dokploy self-hosted PaaS before 0.29.13 lets a low-privileged organization member run arbitrary OS
OS command injection in Dokploy (self-hosted PaaS) version 0.28.8 and earlier lets an authenticated user with permission
OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated user with the backup:restore per
OS command injection in Dokploy self-hosted PaaS prior to 0.29.13 lets an authenticated project member with compose writ
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today