CVE-2026-45661: Dokploy: Remote Code Execution through Path Traversal
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.5 and earlier, a critical path traversal vulnerability exists in Dokploy v0.26.5 that allows authenticated users to write arbitrary files to the filesystem during application deployment. When combined with Dokploy's remote server deployment feature, this vulnerability enables arbitrary file write to remote server filesystems, automatic remote code execution via cron jobs, complete server compromise, data exfiltration without user interaction, and persistent backdoor installation. This vulnerability bypasses all container isolation on remote server deployments.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45661?
The severity of CVE-2026-45661 is critical with a score of 9.9.
How do I fix CVE-2026-45661?
To mitigate CVE-2026-45661, upgrade Dokploy to version 0.26.6 or later where the vulnerability has been patched.
What type of vulnerability is CVE-2026-45661?
CVE-2026-45661 is a path traversal vulnerability that allows authenticated users to write arbitrary files to the filesystem.
Who is affected by CVE-2026-45661?
All users of Dokploy version 0.26.5 and earlier are affected by CVE-2026-45661.
What does CVE-2026-45661 allow an attacker to do?
CVE-2026-45661 allows authenticated attackers to perform remote code execution by leveraging the path traversal vulnerability during application deployment.