CVE-2026-45406

Name of the Vulnerable Software and Affected Versions Dokku versions prior to 0.38.2

Description The openresty-vhosts plugin copies files from an application's openresty/http-includes/ git repository directory to the host. The plugin then interpolates these filenames, without escaping, into a single-quoted shell string that is subsequently processed by the eval() function. A filename containing a single quote can break the quoting mechanism, enabling command substitution to execute arbitrary commands on the host with the privileges of the dokku user during the next application deployment.

Recommendations Update to version 0.38.2.