CVE-2026-45663 — Dokploy: Remote Code Execution via destinationPath in Container File Upload
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.1 and earlier, a command injection vulnerability exists in the Docker file upload functionality. When an a…
Published: 2026-05-29 · CVSS: 9.9 · CVSS 3.1
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.1 and earlier, a command injection vulnerability exists in the Docker file upload functionality. When an authenticated user uploads a file to a container, the destinationPath parameter is not properly sanitized and is directly interpolated into a shell command string. By including shell metacharacters such as ; or ", an attacker can escape the intended docker cp command and execute arbitrary OS commands on the Dokploy host.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7