Dokploy - vulnerabilities (CVEs)

60 CVEs in 1 products, 2 in the last 30 days, newest from 2026-10-25.

Products

• Dokploy - 57 CVEs

Newest CVEs of Dokploy

• CVE-2026-116068 - CVSS 8.8 (high), 2026-10-25: Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications…
• CVE-2026-111331 - CVSS 6.3 (medium), 2026-10-15: Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated owners or admins of any…
• CVE-2026-93425 - CVSS 9.9 (critical), 2026-09-24: Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled…
• CVE-2026-86059 - CVSS 9.6 (critical), 2026-09-22: Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy organization members without Git provider access can retrieve…
• CVE-2026-82954 - CVSS 9.9 (critical), 2026-08-31: A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the function writeTraefikConfigInPath of the file…
• CVE-2026-45791 - CVSS 5.9 (medium), 2026-08-17: Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts…
• CVE-2026-45790 - CVSS 8 (high), 2026-08-17: Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's organization.inviteMember tRPC procedure in…
• CVE-2026-72902 - CVSS 9.9 (critical), 2026-08-10: Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a local…
• CVE-2026-72901 - CVSS 9.9 (critical), 2026-08-10: Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated low-privilege member to execute arbitrary…
• CVE-2026-72886 - CVSS 9.9 (critical), 2026-08-10: Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.2 until 0.29.13, schedule.create and schedule.update in…
• CVE-2026-72885 - CVSS 0 (none), 2026-08-10: Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, dockerContextPath accepted by…
• CVE-2026-72884 - CVSS 8.7 (high), 2026-08-10: Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, sanitizeCommand in packages/server/src/utils/builders/compose.ts only trims…
• CVE-2026-72883 - CVSS 8.8 (high), 2026-08-10: Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the WebSocket handlers in apps/dokploy/server/wss/terminal.ts,…
• CVE-2026-72882 - CVSS 9.9 (critical), 2026-08-10: Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, an authenticated user who can create or update file mounts for a service…
• CVE-2026-72881 - CVSS 6.4 (medium), 2026-08-10: Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, database backup and restore command builders in…
• CVE-2026-72880 - CVSS 9.9 (critical), 2026-08-10: Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the apiCreateCertificate schema in…
• CVE-2026-72879 - CVSS 9.4 (critical), 2026-08-10: Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.8, the getRegistryCommands() function in…
• CVE-2026-72878 - CVSS 9.6 (critical), 2026-08-10: Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy's backup and restore pipeline constructs shell commands by directly…
• CVE-2026-72877 - CVSS 9.6 (critical), 2026-08-10: Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the dockerImage field is interpolated without quoting into shell commands in…
• CVE-2026-72876 - CVSS 9.9 (critical), 2026-08-10: Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, and swarm.getAppInfos…
• CVE-2026-72875 - CVSS 8.8 (high), 2026-08-10: Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, settings.readTraefikFile in apps/dokploy/server/api/routers/settings.ts…
• CVE-2026-72874 - CVSS 8.7 (high), 2026-08-10: Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, cloneGitRepository in packages/server/src/utils/providers/git.ts interpolates…
• CVE-2026-72873 - CVSS 6.5 (medium), 2026-08-10: Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, application.one in apps/dokploy/server/api/routers/application.ts returns…
• CVE-2026-72872 - CVSS 9.9 (critical), 2026-08-10: Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, application.saveBitbucketProvider stores bitbucketOwner and…
• CVE-2026-72871 - CVSS 7.5 (high), 2026-08-10: Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the unauthenticated /api/providers/github/setup route in…
• CVE-2026-72870 - CVSS 8.7 (high), 2026-08-10: Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the buildRemoteDocker() function in…
• CVE-2026-72869 - CVSS 9.9 (critical), 2026-08-10: Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription passes the databaseName…
• CVE-2026-72868 - CVSS 9.9 (critical), 2026-08-10: Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, apps/dokploy/server/api/routers/destination.ts interpolates the accessKey,…
• CVE-2026-72867 - CVSS 9.9 (critical), 2026-08-10: Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves…
• CVE-2026-72866 - CVSS 8.8 (high), 2026-08-10: Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the WebSocket handler in apps/dokploy/server/wss/terminal.ts validates a…