Critical · published January 28, 2026
🚨 A sneaky command injection vulnerability lurks in Dokploy's WebSocket endpoint, allowing authenticated attackers to unleash chaos on the host server! 🔥 Think of it as a restaurant where the chef takes orders without checking the ingredients, leading to disastrous substitutions in the meals served. In this case, the server executes commands without properly validating them—potentially serving up anything an attacker desires! An attacker with access could run arbitrary commands directly on the host server, allowing them to manipulate data, compromise sensitive information, or even take full control. This could lead to complete system takeovers and devastating consequences for your entire infrastructure!
Think of it as a restaurant where the chef takes orders without checking the ingredients, leading to disastrous substitutions in the meals served. In this case, the server executes commands without properly validating them—potentially serving up anything an attacker desires! This command injection vulnerability allows attackers to inject malicious commands through the `containerId` and `activeWay` parameters of the `/docker-container-terminal` endpoint, without any sanitization. As a result, if these parameters are crafted carefully, they can run any command on the server.
An attacker with access could run arbitrary commands directly on the host server, allowing them to manipulate data, compromise sensitive information, or even take full control. This could lead to complete system takeovers and devastating consequences for your entire infrastructure! Upgrade Dokploy to version 0.26.6 immediately to patch this vulnerability. Review your current user access controls to ensure that only trusted users can access the WebSocket endpoint. Monitor your logs for any suspicious activity in case this has already been exploited! You've got this! Follow these steps to secure your environment and keep those cyber villains at bay! 🛡️