CVE-2026-45630criticalCWE-78

CVE-2026-45630: fallo crítico en dokploy

Dokploy: Authenticated Remote Code Execution via Command Injection in updateTraefikConfig Echo Statement

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear dokploy

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9epss 0.9%
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, authenticated OS command injection in the application.updateTraefikConfig tRPC endpoint allows admin/owner users to execute arbitrary system commands on remote servers via unsanitized echo shell interpolation.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Productos afectados
Dokploy · dokploy
CVEs relacionadas — dokploy

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-72867CRITICALDokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose.ts)EPSS 3.4%CVE-2026-24841CRITICALDokploy Vulnerable to Authenticated Remote Code Execution via Command Injection in Docker Container Terminal WebSocket EndpointEPSS 2.8%CVE-2026-27130CRITICALDokploy has Command Injection in its Service OperationsEPSS 1.2%CVE-2026-45633CRITICALDokploy: Command Injection in /docker-container-logs EndpointEPSS 1.1%CVE-2025-53376MEDIUMDokploy allows attackers to run arbitrary OS commands on the Dokploy host.EPSS 1.1%CVE-2026-45663CRITICALDokploy: Remote Code Execution via destinationPath in Container File UploadEPSS 1.1%