{"id":"CVE-2026-93425","title":"Dokploy is a free, self-hostable Platform as a Service (PaaS)","summary":"Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in…","severity":"critical","cvss":9.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-78"],"vendor":"Dokploy","product":"dokploy","affected":["dokploy < 0.29.13"],"published":"2026-09-24","updated":"2026-09-24","sourceUpdated":"2026-09-24T18:19:07.280","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93425","references":[{"url":"https://github.com/Dokploy/dokploy/commit/16b5b7293f9883327a89c69fcb6e5718767b064a","label":"security-advisories@github.com"},{"url":"https://github.com/Dokploy/dokploy/releases/tag/v0.29.13","label":"security-advisories@github.com"},{"url":"https://github.com/Dokploy/dokploy/security/advisories/GHSA-56g6-wjr4-5q7p","label":"security-advisories@github.com"},{"url":"https://github.com/Dokploy/dokploy/security/advisories/GHSA-56g6-wjr4-5q7p","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-09-24T17:17:31.094265Z"},"ingestedAt":"2026-09-24T16:47:15.843Z","slug":"CVE-2026-93425","body":"## Overview\n\nDokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe argument quoting. An authenticated organization member with service:read permission can inject shell metacharacters into repoPath and execute arbitrary commands through child_process.exec as root in the Dokploy container. The supplied service identifier is used only to resolve the server and does not constrain repoPath. Because the standard deployment mounts /var/run/docker.sock, container-root command execution can be used to control Docker and compromise the host and its managed applications. This issue is fixed in version 0.29.13.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":66,"depthScoreParts":{"impact":54.5,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":210301,"id":"CVE-2026-93425","ts":1790272169174,"field":"exploit_available","old":"false","new":"true"}]}