PT-2026-5046 · Dokploy · Dokploy

Gh05T666Nero · Published 2026-01-28 · Updated 2026-02-02 · CVE-2026-24841

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.26.6

Description Dokploy is a Platform as a Service (PaaS). A command injection issue exists in versions prior to 0.26.6 within the /docker-container-terminal WebSocket endpoint. The containerId and activeWay parameters are directly used in shell commands without proper sanitization. This allows an authenticated attacker to execute arbitrary commands on the host server.

Recommendations Versions prior to 0.26.6 should be updated to version 0.26.6 or later.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-24841

GHSA-VX6X-6559-X35R

Affected Products

Dokploy

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24841.json · Exploit
• https://github.com/Dokploy/dokploy/security/advisories/GHSA-vx6x-6559-x35r · Vendor Advisory
• https://github.com/Dokploy/dokploy/commit/74e0bd5fe3ef7199f44fcd19c6f5a2f09b806d6f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-24841 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24841 · Vendor Advisory
• https://github.com/Dokploy/dokploy/blob/canary/apps/dokploy/server/wss/docker-container-terminal.ts · Note
• https://twitter.com/CveFindCom/status/2016455596241788946 · Twitter Post
• https://twitter.com/0dayPublishing/status/2016306811427594383 · Twitter Post
• https://t.me/cveNotify/150068 · Telegram Post
• https://twitter.com/pulsepatchio/status/2016885290309198269 · Twitter Post
• https://twitter.com/cracbot/status/2018278282530304371 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2016461044219052180 · Twitter Post
• https://t.me/CVEtracker/43095 · Telegram Post
• https://twitter.com/CVEnew/status/2016319516620235030 · Twitter Post