VULNERABILITY INTELLIGENCE
CVE-2026-45633
CVSS score9.9 CRITICAL
EPSS probability1.14%
CISA KEVNot currently listed
Published2026-05-29
Last modified2026-10-06
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.6 and earlier, Dokploy contains a command injection vulnerability in the /docker-container-logs WebSocket endpoint. The tail and since parameters are not validated and are directly concatenated into shell commands, allowing authenticated users to execute arbitrary commands with root privileges.
Weakness classification
- security-advisories@github.com: CWE-78