PT-2026-44938 · Dokploy · Dokploy

Chakradhar1228 · Published 2026-05-29 · Updated 2026-06-02 · CVE-2026-45661

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.26.6

Description Dokploy is a self-hostable Platform as a Service (PaaS) containing a path traversal issue. This allows authenticated users to write arbitrary files to the filesystem during application deployment. When used with the remote server deployment feature, it enables arbitrary file writes to remote server filesystems, automatic remote code execution via cron jobs, complete server compromise, data exfiltration without user interaction, and persistent backdoor installation. This issue bypasses all container isolation on remote server deployments.

Recommendations Update to a version newer than 0.26.5.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

CWE-35

Related Identifiers

CVE-2026-45661

GHSA-66V7-G3FH-47H3

Affected Products

Dokploy

References · 6

• 🔥 https://github.com/Dokploy/dokploy/security/advisories/GHSA-66v7-g3fh-47h3 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45661.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45661 · Security Note
• https://osv.dev/vulnerability/CVE-2026-45661 · Vendor Advisory
• https://t.me/CVEtracker/55283 · Telegram Post
• https://t.me/cveNotify/165584 · Telegram Post