CVE-2026-88264

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations...

CVE-2026-72864: Missing Authorization

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the local branch of /docker-container-terminal in apps/dokploy/server/wss/docker-container-terminal.ts authenticates with validateRequest but does not authorize the attacker-controlled containerId against the caller's...

CVE-2026-24841

Dokploy is a free, self-hostable Platform as a Service PaaS. In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebSocket endpoint /docker-container-terminal. The containerId and activeWay parameters are directly interpolated into shell commands without...

CVE-2026-24841 Dokploy Vulnerable to Authenticated Remote Code Execution via Command Injection in Docker Container Terminal WebSocket Endpoint

Dokploy is a free, self-hostable Platform as a Service PaaS. In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebSocket endpoint /docker-container-terminal. The containerId and activeWay parameters are directly interpolated into shell commands without...

CVE-2026-24841 Dokploy Vulnerable to Authenticated Remote Code Execution via Command Injection in Docker Container Terminal WebSocket Endpoint

Dokploy is a free, self-hostable Platform as a Service PaaS. In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebSocket endpoint /docker-container-terminal. The containerId and activeWay parameters are directly interpolated into shell commands without...

CVE-2026-24841

Dokploy (PaaS) has a critical authenticated command-injection in versions prior to 0.26.6 via the WebSocket endpoint /docker-container-terminal. The containerId and activeWay parameters are interpolated into shell commands without sanitization, enabling an authenticated attacker to execute arbitr...

CVE-2026-24841

Dokploy is a free, self-hostable Platform as a Service PaaS. In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebSocket endpoint /docker-container-terminal. The containerId and activeWay parameters are directly interpolated into shell commands without...

Dokploy operating system command injection vulnerability

Dokploy is an open-source software developed by Dokploy itself. Versions of Dokploy prior to 0.26.6 contained a vulnerability related to operating system command injection. This vulnerability stemmed from command injection in the WebSocket endpoint/docker-container-terminal, which could allow for...

CVE-2026-24841: Improper Neutralization of Special Elements used in an OS Command

Dokploy is a free, self-hostable Platform as a Service PaaS. In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebSocket endpoint /docker-container-terminal. The containerId and activeWay parameters are directly interpolated into shell commands without...

GO-2023-1888 1Panel vulnerable to command injection when entering the container terminal in github.com/1Panel-dev/1Panel

1Panel vulnerable to command injection when entering the container terminal in github.com/1Panel-dev/1Panel...

GHSA-7X2C-FGX6-XF9H 1Panel vulnerable to command injection when entering the container terminal

Impact The authenticated attacker can craft a malicious payloads to achieve command injection when entering the container terminal. 1. Vulnerability analysis. backend\app\api\v1\terminal.goContainerWsSsh 2. vulnerability reproduction. GET...

1Panel vulnerable to command injection when entering the container terminal

Impact The authenticated attacker can craft a malicious payloads to achieve command injection when entering the container terminal. 1. Vulnerability analysis. backend\app\api\v1\terminal.goContainerWsSsh 2. vulnerability reproduction. GET...

CVE-2023-36458 1Panel vulnerable to ommand injection when entering the container terminal

1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious payloads to achieve command injection when entering the container terminal. The vulnerability has been fixed in v1.3.6...

1Panel 命令注入漏洞

1Panel is an open source Linux server operation and management panel for the Chinese 1Panel community. A command injection vulnerability exists in versions prior to 1.3.6 of 1Panel, which originates from allowing an attacker to build a malicious payload to achieve command injection when entering ...

CVE-2023-36458: Improper Neutralization of Special Elements used in a Command

1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious payloads to achieve command injection when entering the container terminal. The vulnerability has been fixed in v1.3.6...

PT-2023-3483 · 1Panel · 1Panel

Name of the Vulnerable Software and Affected Versions: 1Panel versions prior to 1.3.6 Description: The issue is related to command injection when entering the container terminal in 1Panel, an open source Linux server operation and maintenance management panel. An authenticated attacker can craft...