CVE-2026-45633: Dokploy: Command Injection in /docker-container-logs Endpoint

Severity: critical (CVSS 9.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-29 · updated 2026-10-06
Weakness: CWE-78

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.6 and earlier, Dokploy contains a command injection vulnerability in the /docker-container-logs WebSocket endpoint. The tail and since parameters are not validated and are directly concatenated into shell commands, allowing authenticated users to execute arbitrary commands with root privileges.

Affected products

dokploy: through 0.26.6

References

https://github.com/Dokploy/dokploy/security/advisories/GHSA-wmqj-wr9q-327p
https://github.com/Dokploy/dokploy/security/advisories/GHSA-wmqj-wr9q-327p

Get alerted when CVE-2026-45633 or the next vulnerability affects your stack