CVE-2026-45661

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45661", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-12T21:59:25.665Z", "datePublished": "2026-05-29T16:07:54.491Z", "dateUpdated": "2026-06-02T01:41:47.863Z"}, "containers": {"cna": {"title": "Dokploy: Remote Code Execution through Path Traversal", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-35", "lang": "en", "description": "CWE-35: Path Traversal: '.../...//'", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-66v7-g3fh-47h3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-66v7-g3fh-47h3"}], "affected": [{"vendor": "Dokploy", "product": "dokploy", "versions": [{"version": "<= 0.26.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-29T16:07:54.491Z"}, "descriptions": [{"lang": "en", "value": "Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.5 and earlier, a critical path traversal vulnerability exists in Dokploy v0.26.5 that allows authenticated users to write arbitrary files to the filesystem during application deployment. When combined with Dokploy's remote server deployment feature, this vulnerability enables arbitrary file write to remote server filesystems, automatic remote code execution via cron jobs, complete server compromise, data exfiltration without user interaction, and persistent backdoor installation. This vulnerability bypasses all container isolation on remote server deployments."}], "source": {"advisory": "GHSA-66v7-g3fh-47h3", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-66v7-g3fh-47h3", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-02T01:40:57.073969Z", "id": "CVE-2026-45661", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-02T01:41:47.863Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-45661", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-02T01:40:57.073969Z"}}}], "references": [{"url": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-66v7-g3fh-47h3", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-02T01:41:43.127Z"}}], "cna": {"title": "Dokploy: Remote Code Execution through Path Traversal", "source": {"advisory": "GHSA-66v7-g3fh-47h3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Dokploy", "product": "dokploy", "versions": [{"status": "affected", "version": "<= 0.26.5"}]}], "references": [{"url": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-66v7-g3fh-47h3", "name": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-66v7-g3fh-47h3", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.5 and earlier, a critical path traversal vulnerability exists in Dokploy v0.26.5 that allows authenticated users to write arbitrary files to the filesystem during application deployment. When combined with Dokploy's remote server deployment feature, this vulnerability enables arbitrary file write to remote server filesystems, automatic remote code execution via cron jobs, complete server compromise, data exfiltration without user interaction, and persistent backdoor installation. This vulnerability bypasses all container isolation on remote server deployments."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-35", "description": "CWE-35: Path Traversal: '.../...//'"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-29T16:07:54.491Z"}}}, "cveMetadata": {"cveId": "CVE-2026-45661", "state": "PUBLISHED", "dateUpdated": "2026-06-02T01:41:47.863Z", "dateReserved": "2026-05-12T21:59:25.665Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-29T16:07:54.491Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "dokploy", "vendor": "Dokploy", "versions": [{"status": "affected", "version": "<= 0.26.5"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.5 and earlier, a critical path traversal vulnerability exists in Dokploy v0.26.5 that allows authenticated users to write arbitrary files to the filesystem during application deployment. When combined with Dokploy's remote server deployment feature, this vulnerability enables arbitrary file write to remote server filesystems, automatic remote code execution via cron jobs, complete server compromise, data exfiltration without user interaction, and persistent backdoor installation. This vulnerability bypasses all container isolation on remote server deployments."}, {"lang": "es", "value": "Dokploy es una Plataforma como Servicio (PaaS) gratuita y autoalojable. En la versi\u00f3n 0.26.5 y anteriores, existe una vulnerabilidad cr\u00edtica de salto de ruta en Dokploy v0.26.5 que permite a usuarios autenticados escribir archivos arbitrarios en el sistema de archivos durante el despliegue de aplicaciones. Cuando se combina con la funci\u00f3n de despliegue de servidores remotos de Dokploy, esta vulnerabilidad permite la escritura arbitraria de archivos en sistemas de archivos de servidores remotos, la ejecuci\u00f3n remota de c\u00f3digo autom\u00e1tica a trav\u00e9s de tareas cron, el compromiso completo del servidor, la exfiltraci\u00f3n de datos sin interacci\u00f3n del usuario y la instalaci\u00f3n de puertas traseras persistentes. Esta vulnerabilidad elude todo el aislamiento de contenedores en despliegues de servidores remotos."}], "id": "CVE-2026-45661", "lastModified": "2026-10-06T22:10:00.247", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45661", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-02T01:40:57.073969Z", "version": "2.0.3"}}]}, "published": "2026-05-29T18:17:11.780", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-66v7-g3fh-47h3"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-66v7-g3fh-47h3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-35"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.26.5]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "dokploy", "source": "cna", "vendor": "Dokploy"}, "product": "dokploy", "vendor": "dokploy"}], "created": "2026-05-29T18:30:04.994612+00:00", "updated": "2026-05-29T18:30:05.352033+00:00", "vendors": ["dokploy", "dokploy$PRODUCT$dokploy"]}