Dokploy

Session token invalidation failure in Dokploy allows a stolen better-auth.session_token to persist for up to three days after a victim changes their password, providing an attacker with continued authenticated access even after the victim has attempted to remediate a compromised account. All self-hosted Dokploy deployments prior to version 0.29.6 running the unpatched user.update tRPC procedure are affected. No public exploit identified at time of analysis, but the attack requires only a previously obtained session token and no further interaction from the victim.

Privilege escalation in Dokploy prior to version 0.29.6 allows an authenticated user with member:create permission to permanently seize organization ownership by exploiting two authorization logic flaws: the inviteMember tRPC procedure fails to restrict the role parameter to non-owner values, and the user creation service in user.ts permits arbitrary role assignment on self-hosted instances. Because owner roles cannot be demoted through normal application controls once assigned, a successful takeover is irreversible without direct database intervention. No public exploit code has been identified at time of analysis; vendor-released patch v0.29.6 closes both vulnerable code paths.

Command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user run arbitrary OS commands on the Dokploy host or any SSH-connected target server. The registry.testRegistry and registry.testRegistryById tRPC endpoints interpolate the attacker-supplied registry password directly into a shell command (echo <password> | docker ...) via execAsyncRemote instead of the safe safeDockerLoginCommand helper. Rated CVSS 9.9; no public exploit identified at time of analysis, though the fix commit publicly reveals the vulnerable code path.

Command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated low-privilege member run arbitrary OS commands on the control-plane host. The volumeName field in the volumeBackup.create and volumeBackup.runManually tRPC endpoints is interpolated unquoted into a shell string passed to child_process.exec; because the process holds Docker socket access, injected commands run with host/root-equivalent privileges. No public exploit is identified at time of analysis, but the fix is a one-character-class change and the vulnerable code path is well documented in the published PR and advisory.

Privilege escalation to root in Dokploy (self-hosted PaaS) versions 0.29.2 through 0.29.12 lets a low-privilege organization member who has access to a single application escalate to full host command execution. Because schedule.create/schedule.update derive the internal serviceId from applicationId or composeId but only enforce the owner/admin host-schedule gate in the alternate branch, a member can bind their applicationId to a 'dokploy-server' (host-level) schedule and execute an arbitrary supplied script as root via schedule.runManually. No public exploit identified at time of analysis; fixed in 0.29.13.

Command injection in Dokploy's Docker build pipeline allows authenticated application editors to execute arbitrary OS commands on the Dokploy host by supplying shell metacharacters in the dockerContextPath build configuration field. The malicious path value flows from the dashboard UI through getDockerContextPath() directly into an unquoted cd shell command executed via execAsync, enabling full host-level code execution under the Dokploy server process. All Dokploy installations prior to version 0.29.13 are affected; no active exploitation or public exploit code has been identified at time of analysis, though exploitation requires only a low-privilege authenticated session.

Shell command injection in Dokploy exposes the underlying host OS to arbitrary command execution by any authenticated user with Compose service edit permissions. The flaw is in the sanitizeCommand function within packages/server/src/utils/builders/compose.ts, which stripped only whitespace and surrounding quotes before interpolating user-supplied compose.command values into live shell invocations such as docker ${command} - leaving semicolons, pipe operators, backticks, and subshell substitutions entirely intact. Working exploit payloads (semicolons, $(subshell), pipes, backtick substitution) are publicly available in the fix PR test suite at https://github.com/Dokploy/dokploy/pull/4863; no CISA KEV listing exists at time of analysis, and the vendor-confirmed patch is available in v0.29.13.

Incomplete authorization in Dokploy's WebSocket handlers prior to v0.29.13 allows any authenticated organization member to obtain root terminal access to servers and read logs or statistics for services they were explicitly denied access to. The four affected handlers (terminal.ts, docker-container-terminal.ts, docker-container-logs.ts, docker-stats.ts) verify organization membership but never call checkServiceAccess, getAccessibleServerIds, or accessedServices, nullifying all fine-grained role-based access controls. No public exploit or CISA KEV listing exists; however, the attack requires only a valid low-privilege organization account, making this a meaningful privilege escalation risk in any multi-tenant Dokploy deployment.

OS command injection in Dokploy (self-hosted PaaS) version 0.28.8 and earlier lets an authenticated user with permission to create or update service file mounts inject shell metacharacters via the filePath field, which Dokploy passes to the managed remote server over SSH. Because the default deployment model runs deployments directly against the configured host, this escalates from a web-UI form field to direct remote-host RCE. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum CVSS of 9.9 (scope-changed) reflects the severity of the primitive.

Command injection in Dokploy's database backup and restore utilities (prior to v0.29.13) lets an authenticated administrator execute arbitrary shell commands inside managed database containers by supplying crafted values in database name, username, or password configuration fields. All supported database types are affected - PostgreSQL, MariaDB, MySQL, MongoDB, and LibSQL - with subsequent-system impact rated High across confidentiality, integrity, and availability, reflecting that injected commands run inside the database containers rather than Dokploy itself. No confirmed active exploitation (not in CISA KEV), but the public fix PR includes functional injection payload examples that effectively demonstrate the technique, and the vendor has confirmed the issue via GitHub Security Advisory GHSA-qc73-mp78-4833.

Server-side command injection and path traversal in Dokploy, a self-hostable Platform-as-a-Service, allows an authenticated user holding certificate create or delete permission to supply a crafted certificatePath that is concatenated into shell commands without confinement or escaping. In versions before 0.29.13, this permits writing attacker-controlled content outside the certificate root, deleting arbitrary out-of-root directories, and - because the value reaches unquoted shell invocations (echo ... base64 -d > path, rm -rf certDir) - executing operating-system commands on the host. No public exploit has been identified at time of analysis, though the fixing pull request and commit are public; the flaw is fixed in 0.29.13.

OS command injection in Dokploy self-hosted PaaS before 0.29.8 allows an authenticated user with project access to run arbitrary commands on the Dokploy host. The getRegistryCommands() function in packages/server/src/utils/cluster/upload.ts builds a `docker login` shell string by interpolating the attacker-controlled registry password and URL without escaping, so malicious credentials are executed when a swarm deployment runs. No public exploit identified at time of analysis, but the root cause and fix are fully disclosed in the vendor advisory (GHSA-prwq-2mcm-mvhr), PR #4579, and the v0.29.8 release.

OS command injection in Dokploy self-hosted PaaS (versions prior to 0.29.13) lets an authenticated admin/owner execute arbitrary commands on the underlying host, not merely inside a managed container. The backup/restore, destination, volume-backup, certificate, and mount code paths build bash -c/sh -c strings by directly interpolating user-controlled, database-backed fields (S3 credentials, paths, volume names) and run them through child_process.exec(). No public exploit is identified at time of analysis, but the fix in 0.29.13 confirms multiple confirmed injection sinks, and the container-to-host scope escape makes successful exploitation a full host compromise.

OS command injection in Dokploy self-hostable PaaS versions prior to 0.29.13 lets an authenticated user with application create or update permission achieve arbitrary command execution on the build host. The dockerImage field is interpolated unquoted into shell commands in buildRemoteDocker() (packages/server/src/utils/providers/docker.ts) and validated only as an optional string, so shell command substitution such as $(...) or backticks runs on the local build host or a remote SSH build target. The upstream fix and its regression test publicly demonstrate working injection payloads, so publicly available exploit code exists, though there is no public exploit identified as weaponized and no CISA KEV listing; EPSS was not provided.

Cross-tenant remote command execution in Dokploy (self-hosted PaaS) before 0.29.13 lets any authenticated user holding only the server:read permission run arbitrary OS commands on servers belonging to other organizations. The swarm tRPC endpoints never verified that the supplied serverId belonged to the caller's active organization, and getNodeInfo interpolated an attacker-controlled nodeId straight into a remote shell command, chaining a broken multi-tenant authorization flaw with OS command injection. No public exploit or CISA KEV listing has been identified, though the vendor security advisory and a fix-verification test are public.

Command injection in Dokploy's Traefik configuration reader allows authenticated users holding the traefikFiles.read permission to execute arbitrary OS commands on managed servers by supplying file paths containing shell metacharacters. All Dokploy releases prior to 0.29.13 are affected. The impact is full remote code execution on managed infrastructure: complete confidentiality, integrity, and availability loss on any server managed by the Dokploy instance. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis.

OS command injection in Dokploy before 0.29.13 allows any authenticated user with application access to execute arbitrary commands on the Dokploy host by supplying malicious values for customGitUrl or customGitBranch and triggering a deployment. The cloneGitRepository function in packages/server/src/utils/providers/git.ts interpolates these user-controlled parameters directly into shell commands passed to execAsync or execAsyncRemote without any quoting or escaping. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV, but the attack class is trivially weaponizable and a confirmed patch is available in v0.29.13.

Dokploy's application.one API endpoint exposes unredacted Git provider credentials - including GitHub client secrets, private keys, and webhook secrets, as well as GitLab and Gitea access and refresh tokens, and Bitbucket app passwords - to any authenticated user holding service:read permission, regardless of whether that user has been granted Git provider access. The root cause is that findApplicationById eagerly loads full provider relations without column-level exclusions, and the hasGitProviderAccess authorization check does not prevent these fields from appearing in the returned application object. All Dokploy deployments prior to version 0.29.13 are affected; no public exploit has been identified, though the patch diff published in PR #4859 precisely documents the vulnerable data paths.

OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets a low-privileged team member with service-deployment permission run arbitrary commands on the Dokploy host or a connected target server. The saveBitbucketProvider endpoint persists attacker-controlled bitbucketOwner and bitbucketRepository values without validation, and cloneBitbucketRepository later interpolates them straight into git clone commands run via execAsync/execAsyncRemote. There is no public exploit identified at time of analysis, but the fix (0.29.13) ships regression tests demonstrating the injection payloads, so the mechanism is well documented.

GitHub App provider injection in Dokploy PaaS (prior to v0.29.13) allows unauthenticated remote attackers to insert attacker-controlled GitHub App credentials - including client_secret, webhook_secret, and PEM private key material - into any target organization's configuration by forging the state parameter in the GitHub OAuth callback route. The route /api/providers/github/setup performed no session authentication (CWE-306), blindly trusting organizationId and userId values supplied by the caller in the state query parameter. No public exploit identified at time of analysis; a vendor-released patch is confirmed available as v0.29.13.

OS command injection in Dokploy prior to version 0.29.13 allows any authenticated user with project write access to execute arbitrary commands as the Dokploy server process. The buildRemoteDocker() function in packages/server/src/utils/providers/docker.ts interpolates the user-controlled dockerImage field directly into a shell command passed to execAsync() without sanitization. The same unsanitized interpolation pattern was present across three separate build pipeline files, indicating a systemic rather than isolated flaw. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated user with the backup:restore permission run arbitrary commands on the Docker-privileged host. The backup.restoreBackupWithLogs tRPC subscription forwards an attacker-controlled databaseName into shell strings that Node.js exec passes to /bin/sh before docker exec, so the outer host shell expands injected metacharacters. Rated CVSS 9.9 with a scope change to the host; no public exploit identified at time of analysis, though the upstream fix PR ships regression tests containing working injection payloads.

Command injection in Dokploy self-hosted PaaS before 0.29.13 lets a low-privileged organization member run arbitrary OS commands inside the root Dokploy container, which holds the host Docker socket, effectively yielding host takeover. The destination.testConnection mutation interpolates unsanitized S3 fields (accessKey, secretAccessKey, region, endpoint, provider, bucket) into an rclone shell command run via child_process.exec. No public exploit is identified at time of analysis, but the fix is confirmed in v0.29.13 and the root cause is clearly documented in the upstream patch (PR #4873).

Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged user achieve arbitrary host command execution by storing a malicious Git branch value and triggering a deployment. The branch fields (customGitBranch, branch, gitlabBranch, bitbucketBranch, giteaBranch) were left without server-side validation because the earlier fix for CVE-2026-45628 was incomplete, so attacker-controlled input flows unescaped into shell-based git clone commands. No public exploit has been identified at time of analysis, but the flaw carries a CVSS of 9.9 and is fixed in 0.29.13.

Interactive host-shell access in Dokploy prior to 0.29.13 is obtainable by any authenticated platform user due to a missing authorization check in the WebSocket terminal handler. The handler at apps/dokploy/server/wss/terminal.ts validates the session token but never checks whether the user holds an organization role or server-access grant before spawning a terminal for serverId=local, yielding full interactive shell access on the Dokploy host. No confirmed active exploitation or public exploit code has been identified at time of analysis, but the public security advisory and fix diff make reconstruction trivial for any authenticated user.

OS command injection in Dokploy self-hosted PaaS prior to 0.29.13 lets an authenticated project member with compose write and deploy permissions execute arbitrary commands on the Docker-privileged host. The compose.update operation persists an unvalidated composePath that is later interpolated verbatim into `docker compose -f`, `docker stack deploy -c`, and `touch` commands run via `/bin/sh -c`, so a crafted path fires shell metacharacters when the compose is deployed. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the upstream regression test suite demonstrates working injection payloads, making the path to exploitation well-understood.

Privilege escalation via missing authorization in Dokploy, a self-hostable Platform-as-a-Service, lets any authenticated organization member open a root shell inside arbitrary containers on a self-hosted instance. The /docker-container-terminal WebSocket handler authenticated the caller but never checked the attacker-supplied containerId against the caller's role, organization, or service scope before invoking docker exec. Fixed in 0.29.13; no public exploit identified at time of analysis, though the upstream fix commit is public.

Privilege escalation to host root in Dokploy self-hosted PaaS versions prior to 0.29.13 allows any authenticated organization member to hijack WebSocket terminal and log-streaming handlers that authenticate the session but never check the role/permission model enforced elsewhere. Because these handlers can open an interactive shell into any container - including the Dokploy container that mounts the Docker socket - a low-privileged tenant can obtain root on the host and cross every tenant boundary. No public exploit identified at time of analysis, though the upstream fix commit and a regression test are public. The CVSS is 9.9 driven by scope change and full CIA impact.

Command injection in Dokploy self-hosted PaaS versions prior to 0.29.13 lets an authenticated user with database-service provisioning rights run arbitrary shell commands on managed remote servers. The user-controlled dockerImage field for PostgreSQL, MySQL, MariaDB, MongoDB, Redis, and libSQL services is interpolated unquoted into a 'docker pull ${dockerImage}' command executed over the remote-server code path (execAsyncRemote), enabling shell metacharacter injection. Rated CVSS 9.9 with a scope change; no public exploit or CISA KEV listing is identified, though the patch ships a regression test demonstrating the injection.

OS command injection in Dokploy self-hosted PaaS before 0.29.13 lets an authenticated member with service-deployment permission and an attached SSH key run arbitrary commands on the Dokploy host. The flaw lives in the custom-Git deployment path, where the host portion of a user-supplied customGitUrl is interpolated unquoted into an ssh-keyscan shell command that executes during deployment. No public exploit is identified at time of analysis, but the fix commit is public and the trigger is trivial for anyone with deploy rights.

Command injection in Dokploy's `createCommand()` function allows authenticated users with compose deployment access to execute arbitrary OS commands on the underlying Docker host. All Dokploy releases before 0.29.13 are affected via CPE cpe:2.3:a:dokploy:dokploy:*. The official CVSS score of 6.5 with C:H/I:N/A:N materially understates actual impact - successful exploitation yields full host-level command execution, not merely information disclosure. No public exploit identified at time of analysis, though working injection payloads are published directly in the fix commit's test suite.

Command injection in Dokploy self-hostable PaaS before 0.29.13 lets an authenticated user with backup:read permission run arbitrary OS commands on the Dokploy host. The backup.listBackupFiles tRPC endpoint routes an attacker-controlled search parameter through normalizeS3Path and interpolates it unescaped into an rclone lsjson string executed via child_process.exec(). No public exploit identified at time of analysis, but the root cause and fix are confirmed in the vendor commit and the CVSS 9.9 rating reflects full host compromise from a low-privilege application role.

Cross-tenant authorization bypass in Dokploy 0.29.8 and earlier lets an authenticated organization member with backup permissions reach another organization's S3 backup destinations by supplying a client-controlled destinationId that is never checked against their active organization. Because the referenced destination's S3 accessKey and secretAccessKey are materialized on the attacker's service host, the attacker can read a victim tenant's backup objects and redirect or poison backups across tenant boundaries. No public exploit identified at time of analysis, but the flaw is trivially reachable and breaks the core multi-tenant isolation of the platform (CVSS 9.6, scope-changed).

Remote command injection in Dokploy self-hosted PaaS before 0.29.13 allows an authenticated dashboard user to execute arbitrary shell commands on managed remote nodes. The registry credential-testing and Docker Swarm cluster-management endpoints interpolate user-controlled values (nodeId, imagePrefix/username driving the registry tag) into unquoted shell strings that run over SSH via execAsyncRemote. Rated CVSS 9.9 with scope change; no public standalone exploit is identified, though the public fix commit df2779e and advisory GHSA-4mfc-grxw-6858 disclose the exact vulnerable code paths and injection payloads.

Command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated panel user run arbitrary commands on managed remote servers by embedding a single quote in Traefik configuration fields. The flaw sits in writeTraefikConfigRemote, which interpolates yaml.stringify output into an unsanitized 'echo '...' > file' shell command run over SSH via execAsyncRemote. It is a scope-changing (CVSS 9.9) issue and, notably, an incomplete fix for the earlier CVE-2026-45630; no public exploit is identified at time of analysis, though the fixing commit and advisory are public.

Cross-organization server deletion and SSH key disclosure in Dokploy affects all instances running versions 0.28.7 through 0.29.12. The server.remove tRPC mutation accepts a caller-supplied serverId without verifying organizational ownership, allowing an authenticated owner or administrator in one organization to delete server registrations and all associated deployment records belonging to a completely separate organization - and to receive that organization's plaintext SSH private key as a side effect. No public exploit code has been identified at time of analysis, but the fix is available in version 0.29.13 and the GitHub advisory (GHSA-3rpx-c3j9-q99x) and patch PR are public.

OS command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user holding the backup-restore permission run arbitrary shell commands on the underlying Dokploy host. The backup.restoreBackupWithLogs tRPC subscription concatenates the user-supplied databaseName and backupFile fields directly into database restore and rclone shell pipelines, so crafted values break out of the intended command and execute via execAsync/execAsyncRemote. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the fixing pull request (#4862) ships a regression test enumerating working injection payloads, and the CVSS of 9.9 with scope change reflects full host takeover from a low-privileged application role.

Authenticated OS command injection in Dokploy 0.28.8 and earlier lets any organization member execute arbitrary system commands on remote servers managed by the PaaS via the /listen-deployment WebSocket endpoint, resulting in full server compromise. With a CVSS 9.9 (scope changed) and low-privilege precondition, the flaw effectively turns any low-tier org account into a foothold on every connected host. No public exploit identified at time of analysis, but the vendor security advisory (GHSA-r73h-qr3p-hf7f) confirms the issue.

Missing organization-level authorization in Dokploy 0.19.0 and earlier allows authenticated users from one organization to access, modify, and delete resources belonging to other organizations on the same instance. The shared `protectedProcedure` middleware confirms session authentication but never validates that the requested resource belongs to the caller's active organization, exposing 22 endpoints spanning deployments, backups, volume operations, cluster management, and mounts to cross-organization abuse. No public exploit code has been identified at time of analysis, and this CVE has not been added to the CISA KEV catalog.

Command injection in Dokploy 0.29.2 and earlier allows authenticated users with application create/edit permissions to execute arbitrary shell commands on the host by injecting metacharacters into branch names, repository URLs, or Docker credentials. The flaw stems from unsanitized template-literal interpolation passed to child_process.exec(), and at time of analysis no public exploit identified at time of analysis, but the vendor security advisory GHSA-3frc-cfh9-ch2c documents the issue.

Authenticated OS command injection in Dokploy 0.28.8 and earlier lets admin or owner users execute arbitrary shell commands on remote servers managed by the PaaS through the application.updateTraefikConfig tRPC endpoint. The flaw stems from unsanitized shell interpolation in an echo call, granting full command execution across any host the Dokploy controller manages. No public exploit identified at time of analysis, but the high-privilege admin context combined with cross-server reach makes this a meaningful post-compromise escalation path.

Remote code execution in Dokploy 0.27.0 through 0.29.2 allows unauthenticated attackers to forge email-verification JWTs using a hardcoded BETTER_AUTH_SECRET fallback ('better-auth-secret-123456789'), auto-sign-in as admin, and run arbitrary commands on the host through the built-in SSH terminal. The flaw carries a CVSS 10.0 score with network attack vector and no required privileges, and while no public exploit is identified at time of analysis, the trivially guessable secret makes weaponization straightforward.

Cross-tenant remote code execution in Dokploy 0.26.7 and earlier allows any authenticated user to hijack scheduled tasks belonging to other organizations and execute arbitrary scripts on the Dokploy host or managed remote servers. The schedule router fails to enforce organization and role authorization, so knowledge of a scheduleId/serverId is sufficient to create, modify, or trigger server-type schedules that run attacker-controlled shell commands. No public exploit identified at time of analysis, but the trivial authorization bypass combined with built-in script execution makes this a high-priority issue for multi-tenant Dokploy deployments.

Authenticated command injection in Dokploy 0.26.6 and earlier enables any logged-in user to run arbitrary OS commands as root via the /docker-container-logs WebSocket endpoint. The tail and since parameters are concatenated into shell commands without validation, yielding a CVSS 9.9 (Scope:Changed) issue affecting this self-hosted PaaS. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Authenticated path traversal in Dokploy v0.26.5 and earlier (CWE-22) enables arbitrary file write during application deployment, escalating to remote code execution when the affected instance uses the remote server deployment feature. With a CVSS 9.9 score reflecting scope change and full CIA impact, any user with deployment privileges can drop cron jobs onto remote hosts to fully compromise them, bypassing container isolation. No public exploit identified at time of analysis, though the vendor's own GHSA-66v7-g3fh-47h3 advisory characterizes the chain as critical.

Dokploy self-hosted PaaS prior to 0.26.6 has a critical command injection vulnerability (CVSS 9.9) allowing authenticated users to execute arbitrary OS commands on the host.

Dokploy versions before 0.26.6 contain hardcoded database credentials in the installation script, causing nearly all deployments to share identical credentials that can be obtained from the publicly available install.sh file. An authenticated attacker on the network can leverage these credentials to access the database, potentially achieving high-impact compromise of confidentiality, integrity, and availability. Public exploit code exists for this vulnerability and a patch is available in version 0.26.6 and later.

Dokploy versions up to 0.26.6 is affected by improper restriction of rendered ui layers or frames (CVSS 4.7).

CVE-2025-53825 is a critical unauthenticated remote code execution vulnerability in Dokploy versions prior to 0.24.3, where attackers can execute arbitrary code and access sensitive environment variables by simply opening a pull request on a public repository. This vulnerability affects all public Dokploy instances utilizing preview deployments and carries a CVSS score of 9.4 (Critical), with no authentication or user interaction required, making it immediately exploitable by any network-adjacent attacker.

Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated, low-privileged user can run arbitrary OS commands on the Dokploy host. The tRPC procedure docker.getContainersByAppNameMatch interpolates the attacker-supplied appName value into a Docker CLI call without sanitisation, enabling command injection under the Dokploy service account. This vulnerability is fixed in 0.23.7.

Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated attacker can read any file that the Traefik process user can access (e.g., /etc/passwd, application source, environment variable files containing credentials and secrets). This may lead to full compromise of other services or lateral movement. This vulnerability is fixed in 0.23.7.

A security vulnerability in Dokploy (CVSS 4.3). Remediation should follow standard vulnerability management procedures. Vendor patch is available.