← Back to the live CVE advisory feed

CVE-2026-93425: dokploy

Severity

9.9 (CRITICAL)

Vendor

DOKPLOY

Affected versions

< 0.29.13

Fixed version

0.29.13.

Patch status

Patched

Published

2026-09-24T16:17:25.990

Modified

2026-09-24T18:19:07.280

Why it matters

Critical vulnerability requiring immediate validation against your environment.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Compare installed versions against the affected version range in the advisory.

Technical summary

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe argument quoting. An authenticated organization member with service:read permission can inject shell metacharacters into repoPath and execute arbitrary commands through child_process.exec as root in the Dokploy container. The supplied service identifier is used only to resolve the server and does not constrain repoPath. Because the standard deployment mounts /var/run/docker.sock, container-root command execution can be used to control Docker and compromise the host and its managed applications. This issue is fixed in version 0.29.13.

View the official NVD record for CVE-2026-93425

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.