PT-2026-41737 · Dokploy · Dokploy

Published 2026-05-18 · Updated 2026-05-19 · CVE-2026-27130

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.26.7

Description OS command injection occurs due to inadequate input sanitization, lack of schema validation, and direct shell interpolation. User-controlled application names are processed by the cleanAppName() function, which only replaces spaces and converts text to lowercase, before being interpolated into shell commands executed via execAsync() and execAsyncRemote(). An authenticated attacker can inject shell metacharacters such as ;, $(), backticks, |, or & into the appName parameter during application creation. These commands are executed with server-level privileges when service operations like start, stop, remove, or scale are triggered.

Recommendations Update to version 0.26.7. As a temporary workaround, restrict the use of the appName parameter to alphanumeric characters only until the update is applied.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-27130

Affected Products

Dokploy

References · 9

• 🔥 https://github.com/Dokploy/dokploy/security/advisories/GHSA-fcgq-jjfg-hrhj · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-27130 · Security Note
• https://github.com/Dokploy/dokploy/commit/960892fd8dcf12b7a73a00edaa1b7090fca860c7 · Note
• https://t.me/cveNotify/163929 · Telegram Post
• https://t.me/CVEtracker/54174 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2056545692798099575 · Twitter Post
• https://twitter.com/infoflowcloud/status/2056671558995722349 · Twitter Post
• https://twitter.com/CVEnew/status/2056670122941768029 · Twitter Post
• https://twitter.com/ADKCyber/status/2056810191551627449 · Twitter Post