CVE-2026-24841

9.9 criticalEPSS 2.8%

Critical (9.9) in dokploy dokploy. EPSS 2.8% chance of exploitation in the next 30 days.

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebSocket endpoint `/docker-container-terminal`. The `containerId` and `activeWay` parameters are directly interpolated into shell commands without sanitization, allowing authenticated attackers to execute arbitrary commands on the host server. Version 0.26.6 fixes the issue.

Severity

CVSS 3.1

9.9 critical

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS: 2.8% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2026-01-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dokploy:dokploy

References

https://github.com/Dokploy/dokploy/blob/canary/apps/dokploy/server/wss/docker-container-terminal.ts
https://github.com/Dokploy/dokploy/commit/74e0bd5fe3ef7199f44fcd19c6f5a2f09b806d6f
https://github.com/Dokploy/dokploy/security/advisories/GHSA-vx6x-6559-x35r

Check your stack JSON