漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Dokploy allows attackers to run arbitrary OS commands on the Dokploy host.
Vulnerability Description
Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated, low-privileged user can run arbitrary OS commands on the Dokploy host. The tRPC procedure docker.getContainersByAppNameMatch interpolates the attacker-supplied appName value into a Docker CLI call without sanitisation, enabling command injection under the Dokploy service account. This vulnerability is fixed in 0.23.7.
CVSS Information
N/A
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Vulnerability Title
Dokploy 操作系统命令注入漏洞
Vulnerability Description
Dokploy是Dokploy开源的一个开源软件。 Dokploy 0.23.7之前版本存在操作系统命令注入漏洞，该漏洞源于经过身份验证的低权限用户可在Dokploy主机上运行任意OS命令，可能导致命令注入攻击。
CVSS Information
N/A
Vulnerability Type
N/A