PT-2026-52854 · Dokku · Dokku

Publicado 2026-06-26 · Atualizado 2026-06-26 · CVE-2026-54636

Mitre

CVSS v3.1

9.0

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system cron running as the Dokku user. An app.json cron command utilizing special shell characters - including, but not limited to, > or ; - can break out of the Docker container and execute commands on the host as the Dokku user. This vulnerability is fixed in 0.38.7.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-54636

Produtos afetados

Dokku

Referências · 3

• https://github.com/dokku/dokku/pull/8672 · Correção
• https://github.com/dokku/dokku/security/advisories/GHSA-72vm-7pc2-x95w · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-54636 · Nota de Segurança