Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebSocket endpoint `/docker-container-terminal`. The `containerId` and `activeWay` parameters are directly interpolated into shell commands without sanitization, allowing authenticated attackers to execute arbitrary commands on the host server. Version 0.26.6 fixes the issue.

INFO

Published Date :

2026-01-28T00:18:23.724Z

Last Modified :

2026-01-28T14:59:11.561Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-24841 vulnerability.

Vendors Products
Dokploy
  • Dokploy
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-24841.

URL Resource
https://github.com/Dokploy/dokploy/blob/canary/apps/dokploy/server/wss/docker-container-terminal.ts cve-icon cve-icon
https://github.com/Dokploy/dokploy/commit/74e0bd5fe3ef7199f44fcd19c6f5a2f09b806d6f cve-icon cve-icon
https://github.com/Dokploy/dokploy/security/advisories/GHSA-vx6x-6559-x35r cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact