Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch, branch, gitlabBranch, bitbucketBranch, or giteaBranch. A low-privileged authenticated user can trigger compose.deploy, which passes the stored branch to shell-based Git clone commands in packages/server/src/utils/providers/git.ts, github.ts, gitlab.ts, bitbucket.ts, and gitea.ts, resulting in arbitrary host command execution. This issue is fixed in version 0.29.13.
Published: 2026-08-10
Score: 9.9 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability originates from missing server‑side validation of branch fields in the compose deployment pipeline. Store‑time injection allows a low‑privileged authenticated user to supply a malicious branch value, which is later interpolated into shell‑based Git clone commands during compose deployment. Consequences are full remote code execution on the host running Dokploy, compromising confidentiality, integrity, and availability of the entire system.

Affected Systems

Dokploy Platform as a Service, community edition. Versions from 0.29.3 through 0.29.13 included the vulnerable branch field handling. Versions 0.29.13 and newer contain the fix and are safe.

Risk and Exploitability

The CVSS score of 9.9 marks this as critical. The EPSS score is not available, and it is not listed in the CISA KEV catalog, but the exploitation path requires only a low‑privileged authenticated user who can trigger compose.update. Once a malicious branch is stored, the next compose.deploy call leads to arbitrary host command execution, making the risk extremely high for any environment with exposed authentication.

Generated by OpenCVE AI on August 10, 2026 at 21:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Dokploy to version 0.29.13 or later to apply the fix for branch field validation.
  • Revoke or restrict compose update permissions for low‑privileged users to prevent malicious branch injections.
  • If an upgrade is not immediately possible, block or sanitize compose.update API calls for the branch parameters until a patch can be applied.

Generated by OpenCVE AI on August 10, 2026 at 21:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 11 Aug 2026 03:15:00 +0000

Type Values Removed Values Added
First Time appeared Dokploy
Dokploy dokploy
Vendors & Products Dokploy
Dokploy dokploy

Mon, 10 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
Description Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch, branch, gitlabBranch, bitbucketBranch, or giteaBranch. A low-privileged authenticated user can trigger compose.deploy, which passes the stored branch to shell-based Git clone commands in packages/server/src/utils/providers/git.ts, github.ts, gitlab.ts, bitbucket.ts, and gitea.ts, resulting in arbitrary host command execution. This issue is fixed in version 0.29.13.
Title Dokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose.ts)
Weaknesses CWE-20
CWE-602
CWE-78
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Dokploy Dokploy
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-13T17:34:32.952Z

Reserved: 2026-08-10T15:28:27.616Z

Link: CVE-2026-72867

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-10T19:17:35.443

Modified: 2026-08-13T18:18:16.810

Link: CVE-2026-72867

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-11T03:00:04Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-602

    Client-Side Enforcement of Server-Side Security

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')