Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch, branch, gitlabBranch, bitbucketBranch, or giteaBranch. A low-privileged authenticated user can trigger compose.deploy, which passes the stored branch to shell-based Git clone commands in packages/server/src/utils/providers/git.ts, github.ts, gitlab.ts, bitbucket.ts, and gitea.ts, resulting in arbitrary host command execution. This issue is fixed in version 0.29.13.
Published: 2026-08-10
Score: 9.9 Critical
EPSS: 3.4% Low
KEV: No
Impact: Arbitrary host command execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability originates from missing server‑side validation of branch fields in the compose deployment pipeline. Store‑time injection allows a low‑privileged authenticated user to supply a malicious branch value, which is later interpolated into shell‑based Git clone commands during compose deployment. This flaw is an example of CWE‑20 (Improper Input Validation), CWE‑78 (OS Command Injection), and involves the handling of user‑controlled parameters (CWE‑602). Consequences are full remote code execution on the host running Dokploy, compromising confidentiality, integrity, and availability of the entire system.

Affected Systems

Dokploy Platform as a Service, community edition. Versions from 0.29.3 through 0.29.13 included the vulnerable branch field handling. Versions 0.29.13 and newer contain the fix and are safe.

Risk and Exploitability

The CVSS score of 9.9 marks this as critical. The EPSS score is 3%, and it is not listed in the CISA KEV catalog, but the exploitation path requires a low‑privileged authenticated user to first store a malicious branch via compose.update and then trigger compose.deploy. When the next compose.deploy is executed, the stored branch is used in shell‑based Git clone commands, leading to arbitrary host command execution. This makes the risk extremely high for any environment with exposed authentication.

Generated by OpenCVE AI on October 23, 2026 at 00:41 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Dokploy to version 0.29.13 or later, which adds server‑side validation to eliminate the injection flaw (CWE‑20, CWE‑78).
  • Restrict or remove compose.update permissions for low‑privileged users to prevent storage of malicious branch values (mitigates CWE‑602).
  • If immediate upgrade is not possible, implement input validation or sanitization on the compose.update API to refuse or escape branch field values before they are used in shell commands (addresses CWE‑20 and CWE‑78).

Generated by OpenCVE AI on October 23, 2026 at 00:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 11 Aug 2026 03:15:00 +0000

Type Values Removed Values Added
First Time appeared Dokploy
Dokploy dokploy
Vendors & Products Dokploy
Dokploy dokploy

Mon, 10 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
Description Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch, branch, gitlabBranch, bitbucketBranch, or giteaBranch. A low-privileged authenticated user can trigger compose.deploy, which passes the stored branch to shell-based Git clone commands in packages/server/src/utils/providers/git.ts, github.ts, gitlab.ts, bitbucket.ts, and gitea.ts, resulting in arbitrary host command execution. This issue is fixed in version 0.29.13.
Title Dokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose.ts)
Weaknesses CWE-20
CWE-602
CWE-78
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Dokploy Dokploy
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-13T17:34:32.952Z

Reserved: 2026-08-10T15:28:27.616Z

Link: CVE-2026-72867

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-08-10T19:17:35.443

Modified: 2026-09-08T20:54:37.790

Link: CVE-2026-72867

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T00:45:13Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-602

    Client-Side Enforcement of Server-Side Security

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')