CVE-2026-45663: Dokploy: Remote Code Execution via destinationPath in Container File Upload
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.1 and earlier, a command injection vulnerability exists in the Docker file upload functionality. When an authenticated user uploads a file to a container, the destinationPath parameter is not properly sanitized and is directly interpolated into a shell command string. By including shell metacharacters such as ; or ", an attacker can escape the intended docker cp command and execute arbitrary OS commands on the Dokploy host.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the destinationPath parameter is validated and sanitized to reject or escape shell metacharacters (for example ; or "). Do not directly interpolate destinationPath into shell command strings; instead use APIs or command argument forms that do not invoke a shell.
Dokploy container file upload (destinationPath handling) destinationPath interpolation = do not interpolate user-supplied destinationPath into shell commands; validate/sanitize to remove shell metacharacters - Configuration
Disable the container file upload feature or restrict its use to trusted administrators or network segments until a vendor patch/fix is available.
Dokploy container file upload feature = disabled or restricted
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45663?
CVE-2026-45663 has a critical severity score of 9.9.
How do I fix CVE-2026-45663?
To fix CVE-2026-45663, upgrade Dokploy to version 0.29.2 or later, which addresses the command injection vulnerability.
What type of vulnerability is CVE-2026-45663?
CVE-2026-45663 is a command injection vulnerability found in the Docker file upload functionality of Dokploy.
Who is affected by CVE-2026-45663?
Authenticated users of Dokploy version 0.29.1 and earlier are affected by CVE-2026-45663.
What are the potential impacts of CVE-2026-45663?
CVE-2026-45663 allows remote code execution, which can lead to unauthorized access and control over the affected system.