CVE-2026-45661: Dokploy: Remote Code Execution through Path Traversal

Synopsis

A path traversal flaw in Dokploy (a self-hostable PaaS) lets any authenticated user write arbitrary files to the host filesystem during application deployment. The bug is reachable over the network and only requires a low-privilege account, with no victim interaction. When combined with Dokploy's remote server deployment feature, writes land on remote hosts and lead to remote code execution via cron jobs, full server compromise, and persistent backdoors that bypass container isolation. No upstream fix is published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as the maintainers ship one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Dokploy web interface over the network (AV:N).

• AuthenticationRequired

  Any low-privilege authenticated Dokploy account is sufficient (PR:L).

• Victim interactionNot required

  No administrator or user action is needed; exploitation runs entirely from the attacker's session (UI:N).

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race or environmental prerequisites (AC:L).

Blast Radius

• Writes arbitrary files to the Dokploy host filesystem and, via the remote deployment feature, to connected remote servers.
• Achieves remote code execution by dropping cron job files that the scheduler executes automatically.
• Reads and exfiltrates application data, secrets, and credentials reachable from the compromised host.
• Installs persistent backdoors that survive redeploys and bypass container isolation on remote targets.