Dokploy <= 0.29.12 - Authenticated RCE via Command Injection

Dokploy ... and executed via /bin/sh during deploy packages/server/src/utils/providers/git.ts - childprocess.exec. An authenticated user can inject shell metacharacters to achieve remote code execution on the Dokploy host. id: CVE-2026-72867 info: name: Dokploy ... and executed via /bin/sh during...

CVE-2026-128328

Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to list tracked files of any git repository by supplying an arbitrary repoPath to patch.readRepoDirectories. Attackers with read access to one service can enumerate file and directo...

CVE-2026-128328

Dokploy versions 0.28.0 before 0.31.1 are vulnerable to a path traversal vulnerability within the patch.readRepoDirectories function. An authenticated organization member can supply an arbitrary repoPath to list tracked files of any git repository. This flaw allows an attacker with read access to...

CVE-2026-128328 Dokploy 0.28.0 before 0.31.1 Path Traversal via patch.readRepoDirectories repoPath

Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to list tracked files of any git repository by supplying an arbitrary repoPath to patch.readRepoDirectories. Attackers with read access to one service can enumerate file and directo...

CVE-2026-128329

Dokploy versions 0.28.0 before 0.31.1 are vulnerable to a path traversal vulnerability in the patch.readRepoFile function. Authenticated organization members with service read permissions can read arbitrary files by supplying ../ sequences in the filePath parameter. This flaw allows for the unaut...

EUVD-2026-125048

Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to read arbitrary files by supplying ../ sequences in the filePath of patch.readRepoFile. Attackers with service read permission can read /etc/shadow, SSH private keys, and secret...

EUVD-2026-125049

Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to list tracked files of any git repository by supplying an arbitrary repoPath to patch.readRepoDirectories. Attackers with read access to one service can enumerate file and directo...

EUVD-2026-124738

Dokploy before 0.31.1 contains a missing ownership check vulnerability in the readAppMonitoring tRPC procedure that allows authenticated attackers to access container metrics belonging to other organizations by supplying an arbitrary appName. Attackers can query getApplicationStats with any...

CVE-2026-127212: dokploy: Dokploy before 0.31.1 contains a missing ownership check vulnerability in the readAppMonitoring tRPC procedure that…

Dokploy before 0.31.1 contains a missing ownership check vulnerability in the readAppMonitoring tRPC procedure that allows authenticated attackers to access container metrics belonging to other organizations by supplying an arbitrary appName. Attackers can query getApplicationStats with any...

CVE-2026-127212 Dokploy < 0.31.1 Broken Access Control via readAppMonitoring

Dokploy before 0.31.1 contains a missing ownership check vulnerability in the readAppMonitoring tRPC procedure that allows authenticated attackers to access container metrics belonging to other organizations by supplying an arbitrary appName. Attackers can query getApplicationStats with any...

CVE-2026-127212

Dokploy versions prior to 0.31.1 are vulnerable to a broken access control flaw in the readAppMonitoring tRPC procedure. The root cause is a missing ownership check , which allows authenticated attackers to access container metrics belonging to other organizations on self-hosted multi-tenant inst...

CVE-2026-72867

CVE-2026-72867 — Dokploy compose branch command injection Working, stdlib-only PoC. A low-privileged authenticated user stores a shell payload in a compose branch field compose.update, queues a deploy compose.deploy, and reads the command output back from the deployment log deployment.readLogs. N...

PT-2026-146083

Dokploy before 0.31.1 contains a missing ownership check vulnerability in the readAppMonitoring tRPC procedure that allows authenticated attackers to access container metrics belonging to other organizations by supplying an arbitrary appName. Attackers can query getApplicationStats with any...

CVE-2026-72867-CVSS-9.9-Critical

CVE-2026-72867 — Dokploy compose branch name stored command injection Severity: CVSS:3.1 9.9 / 10.0 Critical · AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · Full rating Reproduction status: this repository's rewritten script, on 2026-10-21 against the local lab ofdokploy/dokploy:v0.29.12, hit twice out o...

CVE-2026-116068

Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to...

EUVD-2026-109382

Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to...

CVE-2026-116068 Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router

Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to...

CVE-2026-116068

Versions of Dokploy up to and including 0.30.10 are vulnerable to a cross-organization authorization bypass via the Application tRPC Router. The flaw allows owners or admins of one organization to control applications belonging to other tenants by providing foreign applicationId values . Exploita...

CVE-2026-116068 Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router

Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to...

CVE-2026-116068 Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router

Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to...