CVE-2026-27130
OS Command Injection in Dokploy Self-Hosted PaaS
Publication date: 2026-05-18
Last updated on: 2026-05-19
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dokploy | dokploy | to 0.26.7 (exc) |
| dokploy | dokploy | 0.26.7 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Dokploy versions 0.26.6 and below, where an OS command injection occurs through the appName parameter. The issue arises from three chained problems: inadequate input sanitization, lack of schema validation, and direct shell interpolation. Specifically, user-controlled application names are only partially sanitized (spaces replaced and converted to lowercase) before being directly inserted into shell commands executed by execAsync() and execAsyncRemote(). An authenticated attacker can inject shell metacharacters (such as ;, $(), backticks, |, &) into the appName field during application creation, which are then executed with server-level privileges when service operations like start, stop, remove, or scale are performed.
How can this vulnerability impact me? :
This vulnerability can have severe impacts because it allows an authenticated attacker to execute arbitrary shell commands on the server with elevated privileges. This can lead to full compromise of the server hosting Dokploy, including unauthorized access, data theft, data modification, service disruption, or further attacks within the network.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is resolved in Dokploy version 0.26.7. The immediate step to mitigate this vulnerability is to upgrade Dokploy to version 0.26.7 or later.
Until the upgrade is applied, restrict access to the application creation functionality to trusted users only, as the vulnerability requires authenticated access.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Dokploy allows an authenticated attacker to execute arbitrary OS commands with server-level privileges due to command injection via the appName parameter.
Such a vulnerability can lead to unauthorized access, data breaches, or manipulation of sensitive data, which may violate compliance requirements under standards like GDPR or HIPAA that mandate protection of personal and sensitive information.
Therefore, if exploited, this vulnerability could compromise the confidentiality, integrity, and availability of data, potentially resulting in non-compliance with these regulations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves OS command injection through the appName parameter in Dokploy versions 0.26.6 and below. Detection involves identifying if an attacker is injecting shell metacharacters (such as ;, $(), backticks, |, &) in the appName field during application creation.
To detect exploitation attempts on your system or network, you can monitor logs for suspicious appName values containing shell metacharacters or unusual command execution patterns triggered by service operations (start, stop, remove, scale).
Suggested commands to help detect this vulnerability include searching application logs or process execution logs for suspicious appName inputs or shell commands. For example:
- Use grep to find suspicious appName values in logs: grep -E 'appName.*[;`$|&]' /path/to/dokploy/logs/*
- Monitor running processes for unexpected commands spawned by Dokploy: ps aux | grep dokploy
- Check for unusual shell commands executed by Dokploy service operations by auditing shell command execution logs or using system audit tools like auditd.
Note that these commands are general suggestions based on the nature of the vulnerability and may need to be adapted to your specific environment and logging setup.