CVE-2026-27130: Dokploy has Command Injection in its Service Operations
Dokploy is a free, self-hostable Platform as a Service (PaaS). Versions 0.26.6 and below have OS command injection through the appName parameter. 3 chained issues cause this problem: inadequate input sanitization, lack of schema validation and direct shell interpolation. User-controlled application names are passed through inadequate sanitization (cleanAppName function only replaces spaces and converts to lowercase) before being interpolated directly into shell commands executed via execAsync() and execAsyncRemote(). An authenticated attacker can inject shell metacharacters (e.g., ;, $(), backticks, |, &) in the appName field during application creation, which are then executed with server-level privileges when service operations (start, stop, remove, scale) are triggered. This issue has been resolved in version 0.26.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokployto a version that resolves this vulnerability.Fixed in 0.26.7 - Configuration
Ensure user-controlled application names (appName) are properly sanitized and not interpolated directly into shell commands executed by execAsync() / execAsyncRemote() during service operations (start, stop, remove, scale). The reported issue is that cleanAppName() only replaces spaces and converts to lowercase, which is insufficient.
Dokploy service operations (execAsync/execAsyncRemote) appName interpolation into shell commands = sanitize and avoid direct shell interpolation (e.g., do not interpolate user-controlled appName into shell metacharacter-sensitive command strings)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27130?
CVE-2026-27130 has a high severity due to the potential for command injection that can lead to unauthorized access and system compromise.
How do I fix CVE-2026-27130?
To fix CVE-2026-27130, upgrade Dokploy to version 0.26.7 or later, where the command injection vulnerability has been addressed.
What versions of Dokploy are affected by CVE-2026-27130?
CVE-2026-27130 affects all Dokploy versions up to and including 0.26.6.
What are the risks associated with CVE-2026-27130?
The risks include the potential execution of arbitrary commands on the server, leading to data compromise and service disruption.
Is input sanitization sufficient to mitigate CVE-2026-27130?
No, input sanitization alone is not sufficient; a combination of schema validation and proper coding practices is necessary to fully mitigate the risks.