Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

dokploy — Vulnerabilities & Security Advisories 59

All 59 CVE vulnerabilities found in dokploy, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities associated with Dokploy, a self-hosted deployment platform. The collection encompasses various weakness types, including remote code execution, authentication bypasses, and configuration errors, covering disclosures from the product's initial release through the most recent updates. Readers can utilize this resource to track vendor advisories, understand specific weakness classes within the deployment tooling ecosystem, and review the complete vulnerability history of Dokploy. The data is organized to facilitate technical analysis rather than general awareness, allowing security professionals and developers to identify patterns in reported flaws. By consolidating information from multiple sources into a single view, this aggregation supports risk assessment and patch management strategies for organizations relying on Dokploy infrastructure. The entries reflect the severity and impact of each issue, providing context for prioritization without requiring users to navigate disparate vendor databases. This centralized approach helps clarify the security posture of the application over time, highlighting recurring themes in its codebase or dependency management. Users should note that while the list is comprehensive, it relies on publicly available disclosures and may not include unannounced or privately reported issues. The focus remains strictly on technical details relevant to system hardening and incident response, avoiding promotional language or non-technical summaries. This structure ensures that stakeholders can efficiently assess the security implications of using Dokploy in production environments, supporting informed decision-making regarding upgrades and mitigations.

Vendor: Dokploy

CVE ID Title CVSS Severity Published
CVE-2026-111331 Dokploy through 0.30.8 Cross-Organization Authorization Bypass via port tRPC Router CWE-639 6.3 Medium 2026-10-15
CVE-2026-93425 Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root CWE-78 9.9 Critical 2026-09-24
CVE-2026-86059 Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.one CWE-200 9.6 Critical 2026-09-22
CVE-2026-82954 Dokploy Settings application.ts writeTraefikConfigInPath path traversal CWE-22 9.9 Critical 2026-08-31
CVE-2026-45791 Dokploy: Password Change Does Not Revoke Active Sessions CWE-613 5.9 Medium 2026-08-17
CVE-2026-45790 Dokploy: Invitation Role Escalation Allows Organization Takeover CWE-269 8.0 High 2026-08-17
CVE-2026-72902 Dokploy: Authenticated RCE via Command Injection in registry.testRegistry / registry.testRegistryById CWE-78 9.9 Critical 2026-08-10
CVE-2026-72901 Dokploy: Remote Code Execution via volume-backup CWE-78 9.9 Critical 2026-08-10
CVE-2026-72886 Dokploy: Non-admin member gains root on the host by bypassing the owner/admin check on server-level schedules (incomplete fix of CVE-2026-45632) CWE-269 9.9 Critical 2026-08-10
CVE-2026-72885 Dokploy: Authenticated Command Injection in Dokploy Dockerfile Builder CWE-78 - - 2026-08-10
CVE-2026-72884 Dokploy: Command Injection via Compose Custom Command CWE-78 8.7 High 2026-08-10
CVE-2026-72883 Dokploy: WebSocket Terminal Missing Service-Level Access Control CWE-862 8.8 High 2026-08-10
CVE-2026-72882 Dokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed servers CWE-78 9.9 Critical 2026-08-10
CVE-2026-72881 Dokploy: Command Injection via database credentials in backup/restore commands CWE-78 6.4 Medium 2026-08-10
CVE-2026-72880 Dokploy: Arbitrary File Write + Remote OS Command Injection via `certificatePath` CWE-78 9.9 Critical 2026-08-10
CVE-2026-72879 Dokploy: Command Injection via Registry Credentials in Swarm Upload CWE-78 9.4 Critical 2026-08-10
CVE-2026-72878 Dokploy: OS Command Injection in backup/restore pipeline via unescaped user-controlled shell arguments CWE-78 9.6 Critical 2026-08-10
CVE-2026-72877 Dokploy: Command Injection via dockerImage in buildRemoteDocker CWE-78 9.6 Critical 2026-08-10
CVE-2026-72876 Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.* CWE-78 9.9 Critical 2026-08-10
CVE-2026-72875 Dokploy: Remote Code Execution (RCE) via Command Injection in settings.readTraefikFile CWE-78 8.8 High 2026-08-10
CVE-2026-72874 Dokploy: Command Injection via Unescaped Git URL in Clone Commands CWE-78 8.7 High 2026-08-10
CVE-2026-72873 Dokploy: Cross-tenant Git provider secrets are disclosed to low-privileged service readers via `application.one` CWE-200 6.5 Medium 2026-08-10
CVE-2026-72872 Dokploy: OS Command Injection via Bitbucket `owner`/`repository` in `git clone` CWE-78 9.9 Critical 2026-08-10
CVE-2026-72871 Dokploy: Unauthenticated Git Provider Injection via GitHub OAuth Callback CWE-306 7.5 High 2026-08-10
CVE-2026-72870 Dokploy: Command Injection via Docker Credentials in buildRemoteDocker CWE-78 8.7 High 2026-08-10
CVE-2026-72869 Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCE CWE-77 9.9 Critical 2026-08-10
CVE-2026-72868 Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injection CWE-78 9.9 Critical 2026-08-10
CVE-2026-72867 Dokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose.ts) CWE-20 9.9 Critical 2026-08-10
CVE-2026-72866 WebSocket Terminal Auth Bypass CWE-862 8.8 High 2026-08-10
CVE-2026-72865 Dokploy: OS Command Injection via compose `composePath` CWE-78 9.9 Critical 2026-08-10

All 59 known CVE vulnerabilities affecting dokploy with full Chinese analysis, references, and POCs where available.