Dokploy

Records59All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical36CVSS 9.0–10.0

CVSS high12CVSS 7.0–8.9

Exploited now

Dokploy records in CISA KEV

No Dokploy vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Dokploy 7 records HIGH

Records

59 records

TI-2026-33375 CVE-2026-45631

Dokploy: Pre-Auth Admin Takeover via Hardcoded Authentication Secret

HIGH 82

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00454 Published 2026-05-29 Fixed in 0.29.3 CWE-798

TI-2025-33717 CVE-2025-53825

Dokploy's Preview Deployments are vulnerable to Remote Code Execution

HIGH 82

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00613 Published 2025-07-14 Fixed in 0.24.3 CWE-862

TI-2026-62972 CVE-2026-93425

Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00617 Published 2026-09-24 Fixed in 0.29.13 CWE-78

TI-2026-58871 CVE-2026-86059

Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.one

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00487 Published 2026-09-22 Fixed in 0.29.13 CWE-200

TI-2026-51118 CVE-2026-72901

Dokploy: Remote Code Execution via volume-backup

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00954 Published 2026-08-10 Fixed in 0.29.13 CWE-78

TI-2026-51110 CVE-2026-72886

Improper privilege management in dokploy

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00523 Published 2026-08-10 Fixed in 0.29.13 CWE-269

TI-2026-51106 CVE-2026-72882

Dokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed servers

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00518 Published 2026-08-10 No fix listed CWE-78

TI-2026-51104 CVE-2026-72880

Dokploy: Arbitrary File Write + Remote OS Command Injection via `certificatePath`

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00416 Published 2026-08-10 Fixed in 0.29.13 CWE-78

TI-2026-51103 CVE-2026-72879

Dokploy: Command Injection via Registry Credentials in Swarm Upload

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00483 Published 2026-08-10 Fixed in 0.29.8 CWE-78

TI-2026-51101 CVE-2026-72877

Dokploy: Command Injection via dockerImage in buildRemoteDocker

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00585 Published 2026-08-10 Fixed in 0.29.13 CWE-78

TI-2026-51100 CVE-2026-72876

Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.*

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00707 Published 2026-08-10 Fixed in 0.29.13 CWE-639

TI-2026-51096 CVE-2026-72872

Dokploy: OS Command Injection via Bitbucket `owner`/`repository` in `git clone`

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.0065 Published 2026-08-10 Fixed in 0.29.13 CWE-78

TI-2026-51093 CVE-2026-72869

Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCE

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.0065 Published 2026-08-10 Fixed in 0.29.13 CWE-77

TI-2026-51091 CVE-2026-72867

Improper input validation in dokploy

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.034 Published 2026-08-10 Fixed in 0.29.13 CWE-20

TI-2026-51089 CVE-2026-72865

Dokploy: OS Command Injection via compose `composePath`

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.0065 Published 2026-08-10 Fixed in 0.29.13 CWE-78

TI-2026-51088 CVE-2026-72864

Dokploy Broken Access Control on docker-container-terminal WebSocket (Member -> Root in Arbitrary Containers)

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00506 Published 2026-08-10 Fixed in 0.29.13 CWE-862

TI-2026-51087 CVE-2026-72863

Dokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain root on the Docker host

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00551 Published 2026-08-10 Fixed in 0.29.13 CWE-269

TI-2026-51086 CVE-2026-72862

Dokploy: OS Command Injection via dockerImage field in database service deployment functions → HOST RCE

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00628 Published 2026-08-10 Fixed in 0.29.13 CWE-78

TI-2026-50975 CVE-2026-72740

Dokploy: OS Command Injection via SSH-form `customGitUrl` domain in `ssh-keyscan`

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00785 Published 2026-08-10 Fixed in 0.29.13 CWE-78

TI-2026-50973 CVE-2026-72738

Dokploy: Authenticated RCE via Command Injection in backup.listBackupFiles search Parameter

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00785 Published 2026-08-10 Fixed in 0.29.13 CWE-78

TI-2026-50972 CVE-2026-72737

Dokploy: Cross-organization IDOR in Dokploy backup destinations exposes another tenant's S3 credentials and backups

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.0035 Published 2026-08-10 No fix listed CWE-639

TI-2026-50970 CVE-2026-72735

Dokploy: Command injection in writeTraefikConfigRemote via shell interpolation of unescaped YAML in SSH remote execution

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00925 Published 2026-08-10 Fixed in 0.29.13 CWE-77

TI-2026-50968 CVE-2026-72733

Dokploy: OS Command Injection via `databaseName` / `backupFile` in database restore

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00717 Published 2026-08-10 Fixed in 0.29.13 CWE-78

TI-2026-33405 CVE-2026-45663

Dokploy: Remote Code Execution via destinationPath in Container File Upload

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01054 Published 2026-05-29 No fix listed CWE-77

TI-2026-33403 CVE-2026-45661

Dokploy: Remote Code Execution through Path Traversal

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00815 Published 2026-05-29 No fix listed CWE-22

Open these records in search →