CVE-2026-45628: Dokploy

Critical severity, CVSS 9.6. EPSS: 0.4% chance of exploitation in the next 30 days.

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.2 and earlier, Dokploy constructs shell commands using JavaScript template literals and executes them via child_process.exec() (which runs through /bin/sh -c). User-supplied branch names, repository URLs, and Docker credentials are interpolated directly into these commands without escaping. This requires an authenticated user with application create/edit privileges.

Affected products

• Dokploy Dokploy: up to and including 0.29.2

Published 2026-05-29. Last modified 2026-10-06.