Dokploy versions 0.26.6 and earlier are vulnerable to a command injection flaw within the /docker-container-logs WebSocket endpoint. The tail and since query parameters are concatenated directly into shell command strings without validation, giving authenticated users the ability to execute arbitrary shell commands with root privileges. This weakness results in complete compromise of the host operating system as the code runs with elevated rights.

The affected product is Dokploy, a self‑hosted Platform as a Service. All releases up to and including version 0.26.6 are impacted; any installation of Dokploy 0.26.6 or earlier carries the vulnerability.

The CVSS score of 9.9 indicates very high severity. The EPSS value is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of a public EPSS score does not diminish the risk posed by the high severity rating. The likely attack vector is via the authenticated WebSocket connection to the /docker-container-logs endpoint, where an attacker can supply crafted tail and since parameters to inject and execute commands.