Is CVE-2026-45405 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45405 being exploited in the wild.

How severe is CVE-2026-45405?

Critical severity, with a CVSS score of 9, published 26 June 2026.

Is there a fix for CVE-2026-45405?

A patch was published on 2026-05-09: Fix merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45405 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-45405?

Check whether you run Dokku at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45405: Dokku arbitrary file write via symlink traversal in archive extraction

CVE-2026-45405 · Severity: critical · CVSS 9 · Published 2026-06-26

Dokku is an open-source Platform-as-a-Service (PaaS) that helps developers deploy and manage applications. A security flaw in how it handles uploaded files allows an attacker to trick the system into writing files to unauthorized locations. This could allow an attacker to gain full administrative control over the server, potentially leading to data theft or service disruption.

Technologies: Dokku. Vendors: Dokku.

Quick answers

Is CVE-2026-45405 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45405 being exploited in the wild.
How severe is CVE-2026-45405?: Critical severity, with a CVSS score of 9, published 26 June 2026.
Which products and versions are affected?: Dokku < 0.38.2.
Is there a fix for CVE-2026-45405?: A patch was published on 2026-05-09: Fix merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45405 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45405?: Check whether you run Dokku at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A symlink traversal vulnerability exists in Dokku's archive extraction logic within the 'git:from-archive' and 'certs:add' commands. The root cause is a failure to sanitize member paths or prevent GNU tar from following symlinks created during the extraction process. An attacker with low privileges can provide a specially crafted tar or zip archive containing symlinks that point outside the intended extraction directory. By following these links, the extraction process can overwrite arbitrary files with the permissions of the 'dokku' user, such as SSH authorized_keys, leading to remote code execution and full shell access. This issue is resolved in version 0.38.2 by implementing archive pre-scanning and utilizing the --no-unsafe-links flag.

Affected products

Dokku Dokku < 0.38.2

Timeline

2026-05-09: patched: Fix merged into master branch
2026-05-10: advisory: Release 0.38.2 published
2026-06-26: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.