What’s Vulnerable › Vulnerabilities

CVE-2026-93425: Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root

• Severity: critical (CVSS 9.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-24 · updated 2026-09-24
• Weakness: CWE-78

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe argument quoting. An authenticated organization member with service:read permission can inject shell metacharacters into repoPath and execute arbitrary commands through child_process.exec as root in the Dokploy container. The supplied service identifier is used only to resolve the server and does not constrain repoPath. Because the standard deployment mounts /var/run/docker.sock, container-root command execution can be used to control Docker and compromise the host and its managed applications. This issue is fixed in version 0.29.13.

Affected products

• dokploy: before 0.29.13

References

• https://github.com/Dokploy/dokploy/commit/16b5b7293f9883327a89c69fcb6e5718767b064a
• https://github.com/Dokploy/dokploy/releases/tag/v0.29.13
• https://github.com/Dokploy/dokploy/security/advisories/GHSA-56g6-wjr4-5q7p
• https://github.com/Dokploy/dokploy/security/advisories/GHSA-56g6-wjr4-5q7p

Get alerted when CVE-2026-93425 or the next vulnerability affects your stack