CVE-2026-45633CWE-78command-injection

CVE-2026-45633

Critical · published May 29, 2026

CVSS v3.1
9.9
EPSS
1%
Percentile
66.2
In the wild
Unconfirmed
What it is

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.6 and earlier, Dokploy contains a command injection vulnerability in the /docker-container-logs WebSocket endpoint. The tail and since parameters are not validated and are directly concatenated into shell commands, allowing authenticated users to execute arbitrary commands with root privileges.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01135 · 66.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-05-29T22:17Z
References (2)
https://github.com/Dokploy/dokploy/security/advisories/GHSA-wmqj-wr9q-327p · [email protected]https://github.com/Dokploy/dokploy/security/advisories/GHSA-wmqj-wr9q-327p · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 29 MAY 16:10Z
    Dokploy: Command Injection in /docker-container-logs Endpoint
    cvelistv5