CVE-2026-93425
Deferred Deferred - Pending Action

Command Injection in Dokploy Self-Hosted PaaS

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe argument quoting. An authenticated organization member with service:read permission can inject shell metacharacters into repoPath and execute arbitrary commands through child_process.exec as root in the Dokploy container. The supplied service identifier is used only to resolve the server and does not constrain repoPath. Because the standard deployment mounts /var/run/docker.sock, container-root command execution can be used to control Docker and compromise the host and its managed applications. This issue is fixed in version 0.29.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-93425
EUVD
EUVD-2026-86253

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
dokploy dokploy 0.29.8
dokploy dokploy 0.29.13

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an OS command injection vulnerability in Dokploy versions before 0.29.13. The patch.readRepoDirectories function passes a user-controlled repoPath parameter directly into a shell command without proper sanitization. An authenticated organization member with service:read permission can inject shell metacharacters into repoPath to execute arbitrary commands as root in the Dokploy container.

Detection Guidance

Check Dokploy version with: docker exec <dokploy-container> dokploy --version. If version is below 0.29.13, the system is vulnerable. Inspect logs for unusual commands or access patterns in /var/log/dokploy or container logs.

Impact Analysis

An attacker could gain root access to the Dokploy container. Since the container typically mounts /var/run/docker.sock, this could allow full control over Docker and compromise the host system and all managed applications. The attacker only needs low-privilege read access to exploit this.

Compliance Impact

This vulnerability could lead to unauthorized access and control of systems handling sensitive data, violating confidentiality requirements in GDPR and HIPAA. The potential for full system compromise means organizations may fail compliance audits and face regulatory penalties.

Mitigation Strategies

Upgrade Dokploy to version 0.29.13 or later immediately. Restrict access to Dokploy to trusted users only. Monitor for unauthorized Docker commands or container activity. Consider isolating the Dokploy container from critical systems.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93425. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart