PT-2026-44903 · Dokploy · Dokploy

Romain-Deperne · Published 2026-05-29 · Updated 2026-06-02 · CVE-2026-45662

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.1

Description Dokploy is a self-hostable Platform as a Service (PaaS). A command injection issue exists in the deleteRegistry() function within the packages/server/src/services/registry.ts file. The application executes a docker logout command using the registryUrl variable without proper shell escaping, allowing for the execution of arbitrary commands when a crafted registryUrl is provided.

Recommendations Update to a version later than 0.29.0. As a temporary workaround, restrict access to the registry deletion functionality until the update is applied.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-45662

Affected Products

Dokploy

References · 3

• 🔥 https://github.com/Dokploy/dokploy/security/advisories/GHSA-827c-7x62-29jq · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45662 · Security Note
• https://t.me/cveNotify/165580 · Telegram Post