EUVD-2026-55790Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable web UI (AV:N) with low complexity; authenticated user with file-mount rights gives PR:L; command runs on a different system (managed host) than the control plane, so S:C with full C/I/A impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, an authenticated user who can create or update file mounts for a service can inject shell metacharacters into filePath, causing Dokploy to execute attacker-controlled commands on the configured remote managed server over SSH. In the default deployment model, this yields direct remote host RCE from the web interface.
AnalysisAI
OS command injection in Dokploy (self-hosted PaaS) version 0.28.8 and earlier lets an authenticated user with permission to create or update service file mounts inject shell metacharacters via the filePath field, which Dokploy passes to the managed remote server over SSH. Because the default deployment model runs deployments directly against the configured host, this escalates from a web-UI form field to direct remote-host RCE. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Dokploy account (PR:L) that has permission to create or update file mounts for a service - that specific capability is the exact prerequisite, and the injection point is the filePath field of a file mount. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are consistent and point to a genuine high priority rather than an inflated score: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) shows network reachability, low complexity, only low privileges, no user interaction, and a scope change reflecting that code executes on a different system (the managed host) than the vulnerable control plane. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who holds (or has phished/compromised) a low-privilege Dokploy account with rights to configure a service's file mounts sets the filePath to a value containing shell metacharacters, for example a path followed by a command-substitution or command-separator payload. When Dokploy processes the mount and runs the corresponding command over SSH against the managed server, the attacker's command executes on that host, yielding remote code execution. … |
| Remediation | Upgrade Dokploy to the fixed release identified in GitHub Security Advisory GHSA-qcf5-jjjp-7794 (https://github.com/Dokploy/dokploy/security/advisories/GHSA-qcf5-jjjp-7794); the advisory is published (patch available per vendor advisory) but the exact fixed version was not included in the input data and must be read from the advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Dokploy deployments and document active versions; immediately restrict administrative and developer access to service file mount creation and update functionality, and review recent audit logs for suspicious configuration changes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Dokploy self-hosted PaaS prior to 0.26.6 has a critical command injection vulnerability (CVSS 9.9) allowing authenticate
Dokploy versions before 0.26.6 contain hardcoded database credentials in the installation script, causing nearly all dep
Command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated low-privilege member run arbitrary
Remote code execution in Dokploy 0.27.0 through 0.29.2 allows unauthenticated attackers to forge email-verification JWTs
Command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user run arbitrary OS commands on
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Command injection in Dokploy self-hosted PaaS versions prior to 0.29.13 lets an authenticated user with database-service
OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets a low-privileged team member with service-deploym
Command injection in Dokploy self-hosted PaaS before 0.29.13 lets a low-privileged organization member run arbitrary OS
OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated user with the backup:restore per
OS command injection in Dokploy self-hosted PaaS prior to 0.29.13 lets an authenticated project member with compose writ
Server-side command injection and path traversal in Dokploy, a self-hostable Platform-as-a-Service, allows an authentica
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today