Vulnerabilities

Filters

1 selected

59 records

Sort

Vendor: Dokploy Clear all filters

TI-2026-80148 CVE-2026-116068 · GHSA-w9rf-wg9h-jgwf

Cross-organization authorization bypass in Dokploy application router

MEDIUM 40

Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00317 Published 2026-10-25 No fix listed CWE-639

TI-2026-75075 CVE-2026-111331

Cross-organization authorization bypass in Dokploy port tRPC router

MEDIUM 57

Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated owners or admins of any organization to manage other tenants' ports because the target applicati…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00324 Published 2026-10-15 No fix listed CWE-639

TI-2026-62972 CVE-2026-93425

Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00617 Published 2026-09-24 Fixed in 0.29.13 CWE-78

TI-2026-58871 CVE-2026-86059

Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.one

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00487 Published 2026-09-22 Fixed in 0.29.13 CWE-200

TI-2026-33526 CVE-2026-45791

Dokploy: Password Change Does Not Revoke Active Sessions

MEDIUM 60

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00408 Published 2026-08-17 Fixed in 0.29.6 CWE-613

TI-2026-33525 CVE-2026-45790

Dokploy: Invitation Role Escalation Allows Organization Takeover

HIGH 70

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00418 Published 2026-08-17 Fixed in 0.29.6 CWE-269

TI-2026-51119 CVE-2026-72902

Dokploy: Authenticated RCE via Command Injection in registry.testRegistry / registry.testRegistryById

MEDIUM 44

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00811 Published 2026-08-10 Fixed in 0.29.13 CWE-78

TI-2026-51118 CVE-2026-72901

Dokploy: Remote Code Execution via volume-backup

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00954 Published 2026-08-10 Fixed in 0.29.13 CWE-78

TI-2026-51110 CVE-2026-72886

Improper privilege management in dokploy

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00523 Published 2026-08-10 Fixed in 0.29.13 CWE-269

TI-2026-51109 CVE-2026-72885

Dokploy: Authenticated Command Injection in Dokploy Dockerfile Builder

MEDIUM 42

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 4.0N/A 0.0 Network No auth No interaction EPSS 0.00818 Published 2026-08-10 Fixed in 0.29.13 CWE-78

TI-2026-51108 CVE-2026-72884

Dokploy: Command Injection via Compose Custom Command

HIGH 73

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00604 Published 2026-08-10 Fixed in 0.29.13 CWE-78

TI-2026-51107 CVE-2026-72883

Dokploy: WebSocket Terminal Missing Service-Level Access Control

MEDIUM 41

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00569 Published 2026-08-10 Fixed in 0.29.13 CWE-862

TI-2026-51106 CVE-2026-72882

Dokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed servers

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00518 Published 2026-08-10 No fix listed CWE-78

TI-2026-51105 CVE-2026-72881

Dokploy: Command Injection via database credentials in backup/restore commands

MEDIUM 62

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 4.0MEDIUM 6.4 Network High privileges No interaction EPSS 0.00672 Published 2026-08-10 Fixed in 0.29.13 CWE-78

TI-2026-51104 CVE-2026-72880

Dokploy: Arbitrary File Write + Remote OS Command Injection via `certificatePath`

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00416 Published 2026-08-10 Fixed in 0.29.13 CWE-78

TI-2026-51103 CVE-2026-72879

Dokploy: Command Injection via Registry Credentials in Swarm Upload

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00483 Published 2026-08-10 Fixed in 0.29.8 CWE-78

TI-2026-51102 CVE-2026-72878

Dokploy: OS Command Injection in backup/restore pipeline via unescaped user-controlled shell arguments

MEDIUM 43

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00478 Published 2026-08-10 Fixed in 0.29.13 CWE-78

TI-2026-51101 CVE-2026-72877

Dokploy: Command Injection via dockerImage in buildRemoteDocker

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00585 Published 2026-08-10 Fixed in 0.29.13 CWE-78

TI-2026-51100 CVE-2026-72876

Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.*

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00707 Published 2026-08-10 Fixed in 0.29.13 CWE-639

TI-2026-51099 CVE-2026-72875

Dokploy: Remote Code Execution (RCE) via Command Injection in settings.readTraefikFile

HIGH 73

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00811 Published 2026-08-10 Fixed in 0.29.13 CWE-78

TI-2026-51098 CVE-2026-72874

Dokploy: Command Injection via Unescaped Git URL in Clone Commands

HIGH 73

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00483 Published 2026-08-10 Fixed in 0.29.13 CWE-78

TI-2026-51097 CVE-2026-72873

Dokploy: Cross-tenant Git provider secrets are disclosed to low-privileged service readers via `application.one`

LOW 29

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00452 Published 2026-08-10 Fixed in 0.29.13 CWE-200

TI-2026-51096 CVE-2026-72872

Dokploy: OS Command Injection via Bitbucket `owner`/`repository` in `git clone`

HIGH 76

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.0065 Published 2026-08-10 Fixed in 0.29.13 CWE-78

TI-2026-51095 CVE-2026-72871

Dokploy: Unauthenticated Git Provider Injection via GitHub OAuth Callback

HIGH 72

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00491 Published 2026-08-10 Fixed in 0.29.13 CWE-306

TI-2026-51094 CVE-2026-72870

Dokploy: Command Injection via Docker Credentials in buildRemoteDocker

HIGH 73

Dokploy is a free, self-hostable Platform as a Service (PaaS).

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00483 Published 2026-08-10 Fixed in 0.29.13 CWE-78