CVE-2026-45628
CRITICALDokploy: Command Injection via Unescaped Branch Fields in Deployment Pipeline
Title source: cnaDescription
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.2 and earlier, Dokploy constructs shell commands using JavaScript template literals and executes them via child_process.exec() (which runs through /bin/sh -c). User-supplied branch names, repository URLs, and Docker credentials are interpolated directly into these commands without escaping. This requires an authenticated user with application create/edit privileges.
References (1)
Core 1
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/Dokploy/dokploy/security/advisories/GHSA-3frc-cfh9-ch2c
Scores
CVSS v3
9.6
EPSS
0.0023
EPSS Percentile
13.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-20
CWE-77
Status
published
Products (1)
Dokploy/dokploy
<= 0.29.2
Published
May 29, 2026
Tracked Since
May 29, 2026