Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, authenticated OS command injection in the application.updateTraefikConfig tRPC endpoint allows admin/owner users …

Critical CVSS 9.0

CVECVE-2026-45630

First seen2026-07-22 07:15 UTC

Disclosed2026-05-29 18:17 UTC

Last updated2026-07-22 07:15 UTC

Channel statusauto

Summary

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, authenticated OS command injection in the application.updateTraefikConfig tRPC endpoint allows admin/owner users to execute arbitrary system commands on remote servers via unsanitized echo shell interpolation.

In-depth triage · Auto channel

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Sources

NVD DATABASE

Original Links

https://github.com/Dokploy/dokploy/security/advisories/GHSA-p787-6gqg-cvp5
https://github.com/Dokploy/dokploy/security/advisories/GHSA-p787-6gqg-cvp5

Timeline

2026-07-22 nvd_ingest NVD