Dokploy has Command Injection in its Service Operations_CVE-2026-27130

9.9 / 10

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Versions 0.26.6 and below have OS command injection through the appName parameter. 3 chained issues cause this problem: inadequate input sanitization, lack of schema validation and direct shell interpolation. User-controlled application names are passed through inadequate sanitization (cleanAppName function only replaces spaces and converts to lowercase) before being interpolated directly into shell commands executed via execAsync() and execAsyncRemote(). An authenticated attacker can inject shell metacharacters (e.g., ;, $(), backticks, |, &) in the appName field during application creation, which are then executed with server-level privileges when service operations (start, stop, remove, scale) are triggered. This issue has been resolved in version 0.26.7.

AI Analysis

OS command injection vulnerability in Dokploy versions 0.26.6 and below, allowing authenticated attackers to inject shell metacharacters and execute commands with server-level privileges.

Basic Information

ID CVE-2026-27130

Source GitHub_M

Published May 18, 2026 at 20:58

Affected Product

Vendor Dokploy

Product dokploy

Version < 0.26.7

Affected Versions Dokploy dokploy < 0.26.7

CWE Classification

CWE-78

AI Assessment

AI Score 9.9 / 10

AI Severity Critical

Vendor Dokploy

Product Dokploy

Version 0.26.6 and below

References

{
    "lastseen": "",
    "description": "Dokploy is a free, self-hostable Platform as a Service (PaaS). Versions 0.26.6 and below have OS command injection through the appName parameter. 3 chained issues cause this problem: inadequate input sanitization, lack of schema validation and direct shell interpolation. User-controlled application names are passed through inadequate sanitization (cleanAppName function only replaces spaces and converts to lowercase) before being interpolated directly into shell commands executed via execAsync() and execAsyncRemote(). An authenticated attacker can inject shell metacharacters (e.g., ;, $(), backticks, |, &) in the appName field during application creation, which are then executed with server-level privileges when service operations (start, stop, remove, scale) are triggered. This issue has been resolved in version 0.26.7.",
    "published": "2026-05-18T20:58:42.885Z",
    "modified": "2026-05-18T20:58:42.885Z",
    "type": "cve",
    "title": "Dokploy has Command Injection in its Service Operations",
    "source": "GitHub_M",
    "references": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-fcgq-jjfg-hrhj\nhttps://github.com/Dokploy/dokploy/commit/960892fd8dcf12b7a73a00edaa1b7090fca860c7",
    "id": "CVE-2026-27130",
    "bulletinFamily": "",
    "cwe": [
        "CWE-78"
    ],
    "cvelist": null,
    "sourceData": "Dokploy dokploy < 0.26.7",
    "sourceHref": "",
    "cvss": {
        "score": 9.9,
        "severity": "CRITICAL",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "dokploy",
    "version": "< 0.26.7",
    "vendor": "Dokploy",
    "ai_description": "OS command injection vulnerability in Dokploy versions 0.26.6 and below, allowing authenticated attackers to inject shell metacharacters and execute commands with server-level privileges.",
    "ai_severity": "Critical",
    "ai_vendor": "Dokploy",
    "ai_product": "Dokploy",
    "ai_version": "0.26.6 and below",
    "ai_score": 9.9
}