External risk intelligence

Dokploy Command Injection via User Input

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-45628

Dokploy is a self-hostable Platform as a Service (PaaS) designed to manage application deployments. As a web-based management portal, it is commonly deployed in internet-accessible environments to facilitate remote management of infrastructure and services, making its interface and associated configuration endpoints likely to be exposed to the internet in typical usage.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in Dokploy, a self-hostable Platform as a Service (PaaS), that could allow authenticated users to execute arbitrary commands on the server. This issue arises from the improper handling of user-supplied input when constructing and executing shell commands. The main concern is confirming relevance and exposure within our environment.

Unescaped user input allows command execution.
Affects applications managing deployments.
Confirm relevance and exposure for potential risk.

Attack Path

How an attacker could exploit the issue

An attacker could begin by gaining access to Dokploy with privileges to create or edit applications. They could then supply malicious input, such as a specially crafted branch name or repository URL, which Dokploy would use to construct a shell command. This command would be executed without proper sanitization, potentially allowing the attacker to compromise the underlying system.

Requires authenticated user access.
User-supplied data constructs shell commands.
Risk of arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

An authenticated user with application creation or editing privileges could potentially execute arbitrary commands on the server. This vulnerability arises when user-supplied data, such as branch names or repository URLs, is directly interpolated into shell commands without proper sanitization.

Server-side command execution.
User input directly interpolated into commands.
Unauthorized server access or control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts self-hosted Dokploy installations, affecting the core functionality of application deployment. Responsibility for addressing this typically falls to the platform or infrastructure team managing the Dokploy environment, in coordination with the application owners who utilize it for deployments. The first critical step is to identify all Dokploy instances, confirm their exposure, and assess which host the most critical applications before planning remediation.

Platform/Infrastructure team owns remediation.
Verify Dokploy instance exposure and reachability.
Plan staged updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dokploy?

Dokploy is a self-hosted Platform as a Service (PaaS). It functions like an internal management dashboard where users can deploy and oversee their applications, databases, and infrastructure. Because it simplifies complex deployment tasks into a web-based interface, it is often used by development teams to streamline how they manage server environments and containerized services.

How does CVE-2026-45628 affect Dokploy?

This vulnerability is a Command Injection issue (CWE-77). It occurs because the software takes user-provided text—like repository URLs or branch names—and inserts it directly into system commands without cleaning it first. This allows the system to mistakenly treat part of a user's input as an actual command, which the server then executes.

Can any user trigger this vulnerability?

No. The vulnerability requires the attacker to be an authenticated user who already has specific permissions to create or edit applications within the Dokploy dashboard. It cannot be triggered by an unauthenticated visitor or a user with restricted, read-only access who lacks the ability to modify application settings.

Is my Dokploy instance at risk?

According to Halo Surface Signal, Dokploy is frequently deployed in internet-accessible environments to allow for remote infrastructure management. If your instance is exposed to the internet, it increases the likelihood that an attacker with valid credentials could reach the management interface to attempt this attack remotely.

What steps should I take if I run Dokploy?

Start by identifying all instances of Dokploy running in your environment to understand your total footprint. Once you have a list, verify which instances are reachable from the internet. Finally, coordinate with your infrastructure or platform team to plan a security update during a scheduled maintenance window to apply the necessary patches.

References

github.com/Dokploy/dokploy/security/advisories/GHSA-3frc-cfh9-ch2c

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.