Executive brief
Dokploy is a self-hostable platform used to manage and deploy applications and databases. A security flaw allows users with basic account access to execute malicious commands on the underlying server with administrative (root) privileges. This could lead to a total system takeover, theft of sensitive database credentials, and access to all hosted applications.
Technical details
A command injection vulnerability exists in Dokploy versions 0.26.6 and earlier within the `/docker-container-logs` WebSocket endpoint. The application fails to validate the `tail` and `since` parameters, which are directly concatenated into a shell command string used to fetch Docker logs via `spawn(shell, ["-c", command])`. An authenticated attacker can use shell metacharacters (e.g., semicolons) to break out of the intended command and execute arbitrary OS commands as the root user. This vulnerability is particularly severe because Dokploy often has the Docker socket mounted, potentially facilitating container escape and full host compromise. At the time of reporting, a patch was pending in version 0.26.7.
Affected products
- Dokploy Dokploy <= 0.26.6
Timeline
- 2026-01-27: other: v0.26.6 released with partial fix
- 2026-01-30: other: Incomplete validation discovered by SHENYI Team
- 2026-05-29: disclosed: CVE published