PT-2026-5046 · Dokploy · Dokploy

Gh05T666Nero · Publicado 2026-01-28 · Atualizado 2026-02-02 · CVE-2026-24841

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.26.6

Description Dokploy is a Platform as a Service (PaaS). A command injection issue exists in versions prior to 0.26.6 within the /docker-container-terminal WebSocket endpoint. The containerId and activeWay parameters are directly used in shell commands without proper sanitization. This allows an authenticated attacker to execute arbitrary commands on the host server.

Recommendations Versions prior to 0.26.6 should be updated to version 0.26.6 or later.

Exploit

Correção

RCE

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-24841

GHSA-VX6X-6559-X35R

Produtos afetados

Dokploy

Referências · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24841.json · Exploit
• https://github.com/Dokploy/dokploy/blob/canary/apps/dokploy/server/wss/docker-container-terminal.ts · Nota
• https://github.com/Dokploy/dokploy/security/advisories/GHSA-vx6x-6559-x35r · Aviso do Fabricante
• https://github.com/Dokploy/dokploy/commit/74e0bd5fe3ef7199f44fcd19c6f5a2f09b806d6f · Correção
• https://twitter.com/CveFindCom/status/2016455596241788946 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2016306811427594383 · Publicação no Twitter
• https://t.me/cveNotify/150068 · Publicação no Telegram
• https://twitter.com/pulsepatchio/status/2016885290309198269 · Publicação no Twitter
• https://twitter.com/cracbot/status/2018278282530304371 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2016461044219052180 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-24841 · Nota de Segurança
• https://t.me/CVEtracker/43095 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-24841 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2016319516620235030 · Publicação no Twitter