CVE-2026-45662

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.0 and earlier, the deleteRegistry function in Dokploy (packages/server/src/services/registry.ts) executes docker logout ${response.registryUrl} without shell escaping. In the same file, the docker login command correctly uses shEscape() to prevent command injection. This inconsistency creates a command injection vulnerability when deleting a registry with a crafted registryUrl.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Dokploy/dokploy/security/advisories/GHSA-827c-7x62-29jq
https://github.com/Dokploy/dokploy/security/advisories/GHSA-827c-7x62-29jq

Configurations

No configuration.

History

No history.

Information

Published : 2026-05-29 16:16

Updated : 2026-07-21 15:10

NVD link : CVE-2026-45662

Mitre link : CVE-2026-45662

CVE.ORG link : CVE-2026-45662

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-45662", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45662", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-02T01:38:53.869308Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Dokploy", "product": "dokploy", "versions": [{"status": "affected", "version": "<= 0.29.0"}]}]}], "published": "2026-05-29T16:16:28.213", "references": [{"url": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-827c-7x62-29jq", "source": "security-advisories@github.com"}, {"url": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-827c-7x62-29jq", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.0 and earlier, the deleteRegistry function in Dokploy (packages/server/src/services/registry.ts) executes docker logout ${response.registryUrl} without shell escaping. In the same file, the docker login command correctly uses shEscape() to prevent command injection. This inconsistency creates a command injection vulnerability when deleting a registry with a crafted registryUrl."}, {"lang": "es", "value": "Dokploy es una Plataforma como Servicio (PaaS) gratuita y autoalojable. En la versi\u00f3n 0.29.0 y anteriores, la funci\u00f3n deleteRegistry en Dokploy (packages/servidor/src/services/registry.ts) ejecuta docker logout ${response.registryUrl} sin escape de shell. En el mismo archivo, el comando docker login utiliza correctamente shEscape() para prevenir la inyecci\u00f3n de comandos. Esta inconsistencia crea una vulnerabilidad de inyecci\u00f3n de comandos al eliminar un registro con una registryUrl manipulada."}], "lastModified": "2026-07-21T15:10:00.103", "sourceIdentifier": "security-advisories@github.com"}