CVE-2026-71849 vulnerabilities

Vulnerabilities for packages: langfuse-fips, wazuh-dashboard-fips, kibana, wazuh-dashboard, langfuse...

CVE-2026-72902

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server because registry.testRegistry and registry.testRegistryById in apps/dokploy/server/api/routers/registry.ts...

CVE-2026-72884

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, sanitizeCommand in packages/server/src/utils/builders/compose.ts only trims whitespace and strips surrounding quotes from compose.command before exportEnvCommand and docker command interpolation, allowing an...

CVE-2026-72877

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the dockerImage field is interpolated without quoting into shell commands in buildRemoteDocker in packages/server/src/utils/providers/docker.ts and is validated only as an optional string. An authenticated user with...

CVE-2026-72879

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.8, the getRegistryCommands function in packages/server/src/utils/cluster/upload.ts interpolates registry.password and registry.registryUrl directly into a shell command without escaping. An authenticated user with project...

CVE-2026-72875

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, settings.readTraefikFile in apps/dokploy/server/api/routers/settings.ts passes a path accepted by apiReadTraefikConfig to readConfigInPath in packages/server/src/utils/traefik/application.ts, where configPath is...

CVE-2026-72902 Dokploy: Authenticated RCE via Command Injection in registry.testRegistry / registry.testRegistryById

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server because registry.testRegistry and registry.testRegistryById in apps/dokploy/server/api/routers/registry.ts...

CVE-2026-72902

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server because registry.testRegistry and registry.testRegistryById in apps/dokploy/server/api/routers/registry.ts...

CVE-2026-72884

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, sanitizeCommand in packages/server/src/utils/builders/compose.ts only trims whitespace and strips surrounding quotes from compose.command before exportEnvCommand and docker command interpolation, allowing an...

CVE-2026-72884

Dokploy prior to v0.29.13 is affected by a command-injection risk in sanitizeCommand (packages/server/src/utils/builders/compose.ts): it only trims whitespace and strips surrounding quotes from compose.command before exportEnvCommand and docker command interpolation, enabling an authenticated use...

CVE-2026-72882

Dokploy: CVE-2026-72882 affects Dokploy 0.28.8 and earlier. An authenticated user who can create or update file mounts can inject shell metacharacters into filePath, causing Dokploy to execute attacker-controlled commands on the configured remote managed server over SSH. In the default deployment...

CVE-2026-72881

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, database backup and restore command builders in packages/server/src/utils/backups/utils.ts and packages/server/src/utils/restore/utils.ts interpolate database names, usernames, and passwords into nested shell command...

CVE-2026-72864

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the local branch of /docker-container-terminal in apps/dokploy/server/wss/docker-container-terminal.ts authenticates with validateRequest but does not authorize the attacker-controlled containerId against the caller's...

CVE-2026-72869

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription passes the databaseName parameter to restore builders in packages/server/src/utils/restore/utils.ts, where PostgreSQL, MariaDB, MySQL, and MongoDB commands embed the...

CVE-2026-72879

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.8, the getRegistryCommands function in packages/server/src/utils/cluster/upload.ts interpolates registry.password and registry.registryUrl directly into a shell command without escaping. An authenticated user with project...

CVE-2026-72879

Summary: Dokploy before version 0.29.8 is affected by a command injection in getRegistryCommands() when building a shell command from registry.password and registry.registryUrl in packages/server/src/utils/cluster/upload.ts. An authenticated user with project access can supply malicious registry ...

CVE-2026-72877

Dokploy (PaaS) contains a command-injection vulnerability in buildRemoteDocker(): the dockerImage field was interpolated into shell commands without quoting, allowing an authenticated user with application create/update permissions to perform shell command substitution and execute arbitrary comma...

CVE-2026-72877 Dokploy: Command Injection via dockerImage in buildRemoteDocker

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the dockerImage field is interpolated without quoting into shell commands in buildRemoteDocker in packages/server/src/utils/providers/docker.ts and is validated only as an optional string. An authenticated user with...

CVE-2026-72877 Dokploy: Command Injection via dockerImage in buildRemoteDocker

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the dockerImage field is interpolated without quoting into shell commands in buildRemoteDocker in packages/server/src/utils/providers/docker.ts and is validated only as an optional string. An authenticated user with...

CVE-2026-72877

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the dockerImage field is interpolated without quoting into shell commands in buildRemoteDocker in packages/server/src/utils/providers/docker.ts and is validated only as an optional string. An authenticated user with...