CVE-2026-45406: fallo crítico en dokku
Dokku: Host RCE via Maliciously Named OpenResty Include Files Injected Through eval
Publicada el
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9epss 0.5%
probabilidad de explotación
0.5%top 57% de las CVE
explotación observada
noninguna fuente lo reporta
Dokku is a docker-powered PaaS. Prior to 0.38.2, the openresty-vhosts plugin copies files from an app's openresty/http-includes/ git repository directory to the host and then interpolates their filenames, unescaped, into a single-quoted shell string that is later parsed by eval. A filename containing a single quote breaks the quoting and allows command substitution to execute arbitrary commands on the host as the dokku user during the app's next deploy. This vulnerability is fixed in 0.38.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Productos afectados
dokku · dokkuCVEs relacionadas — dokku
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-54636CRITICALDokku: OS Command Injection via app.json managed CronEPSS 0.5%CVE-2026-45405CRITICALDokku: Arbitrary File Write via Tar Symlink Traversal in git:from-archive and certs:addEPSS 0.5%CVE-2026-45408CRITICALDokku: OS Command Injection via App Name in Git Pre-Receive HookEPSS 0.4%CVE-2026-45407MEDIUMDokku: Git Credentials in .netrc Stored World-Readable Due to Premature touchEPSS 0.1%