CVE-2026-45628: Dokploy: Command Injection via Unescaped Branch Fields in Deployment Pipeline

Synopsis

Command injection in Dokploy, a self-hostable PaaS, lets an authenticated user with application create/edit privileges run arbitrary shell commands on the host. Dokploy builds shell commands with JavaScript template literals and runs them through child_process.exec() (which invokes /bin/sh -c), interpolating user-supplied branch names, repository URLs, and Docker credentials without escaping. Successful exploitation gives the attacker full read and write access to anything the Dokploy process can reach, including secrets, source, and deployed workloads. No fix has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Dokploy web interface over the network.

• AuthenticationRequired

  A valid Dokploy account with application create or edit privileges is required.

• Victim interactionNot required

  No victim action is needed; the attacker triggers the deployment themselves.

• Attack complexityDetail

  Attack complexity is low: injecting shell metacharacters into a branch name, repository URL, or Docker credential field works reliably.

Blast Radius

• Executes arbitrary shell commands as the Dokploy process user on the host.
• Reads any file the Dokploy process can access, including deployment secrets, Docker credentials, and source repositories.
• Modifies deployment configuration, container images, and pipeline state across applications managed by the instance.
• Pivots into deployed workloads and connected registries using the credentials Dokploy stores.