CVE-2026-45663

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.2

Description An authenticated user can execute arbitrary OS commands on the host system through the Docker file upload functionality. The issue occurs because the destinationPath parameter is not properly sanitized and is directly interpolated into a shell command string. By using shell metacharacters such as ; or ", an attacker can escape the intended docker cp command.

Recommendations Update to version 0.29.2 or later. As a temporary workaround, restrict access to the Docker file upload functionality for untrusted authenticated users.