CVE-2026-93425: Dokploy PaaS Critical RCE Leads to Container Root and Host Compromise TheHackerWire / 1d Telemetry Metric Intelligence Detail CVE Identifier CVE-2026-93425 CVSS Severity 9.9 CRITICAL Affected Target the Dokploy container Vulnerability Class Security Vulnerability Exploit Availability No Public PoC Indexed EPSS Threat Score Awaiting scoring CISA KEV Status Not Listed in CISA KEV Remediation Status Advisory / Mitigation In Review A critical command injection vulnerability, CVE-2026

No standalone public exploit has been published in open research repositories at the time of writing. Our threat intelligence pipeline monitors GitHub, Exploit-DB, and Nuclei feeds continuously. Verified PoCs will be automatically integrated here upon discovery.

A critical command injection vulnerability, CVE-2026-93425, in Dokploy PaaS allows authenticated organization members with service:read permissions to achieve arbitrary command execution as root within the Dokploy container. This flaw, originating from unsafely quoted shell arguments, directly facilitates host compromise through the standard deployment’s mounted Docker socket, enabling full control over the underlying infrastructure and managed applications.

Vulnerability Root Cause & Flaw Mechanism

The root cause of CVE-2026-93425 lies within the Dokploy PaaS, specifically prior to version 0.29.13. The vulnerability manifests in the patch.readRepoDirectories tRPC procedure, defined in apps/dokploy/server/api/routers/patch.ts . This procedure accepts a user-controlled repoPath value, which is subsequently passed without proper argument quoting into a shell command executed via child_process.exec within packages/server/src/services/patch-repo.ts . The mechanical failure mode is a classic shell command injection: an attacker can inject shell metacharacters into the repoPath parameter, causing the underlying shell to interpret and execute arbitrary commands. Execution occurs with root privileges within the Dokploy container. The supplied service identifier parameter is used solely for server resolution and does not impose any constraints on the injectable repoPath value. Crucially, standard Dokploy deployments mount /var/run/docker.sock , enabling container-root command execution to directly interface with the Docker daemon, leading to host compromise and control over all Docker-managed applications.

Attack Prerequisites & Threat Vector

Successful exploitation of CVE-2026-93425 requires an authenticated organization member account. The attacker must possess at least service:read permissions within the Dokploy instance. The attack vector is remote, targeting the Dokploy application interface. The end-to-end attack progression involves an authenticated user crafting a malicious repoPath value containing shell metacharacters. This crafted input is then sent via the patch.readRepoDirectories tRPC procedure. Upon processing, the unsafely incorporated repoPath triggers arbitrary command execution as root within the Dokploy container via child_process.exec . The subsequent access to /var/run/docker.sock allows for immediate escalation to host-level command execution, enabling actions such as creating privileged containers, extracting sensitive data, or manipulating other deployed services.

Detection, Log Analysis & Threat Hunting

SOC analysts and threat hunters should focus on Dokploy application logs for anomalous requests to the patch.readRepoDirectories tRPC procedure. Specific telemetry indicators include URI patterns or request bodies containing the repoPath parameter with shell metacharacters such as ; , | , & , ` , $() , or other command separators. Container runtime monitoring should flag unexpected child_process.exec invocations originating from the Dokploy container, particularly those attempting to interact with /var/run/docker.sock or execute unusual system commands. Furthermore, any new or modified Docker containers, images, or volumes initiated from the Dokploy container’s context are strong indicators of compromise. For external asset discovery, a realistic Shodan dork is http.title:"Dokploy" or http.html:"Dokploy" to identify publicly exposed Dokploy instances.

Defensive Hardening & Mitigation

For systems awaiting the vendor patch, immediate defensive hardening measures are critical. Implement network segmentation to isolate Dokploy instances, restricting access to administrative interfaces and the application itself to trusted internal networks or specific IP ranges. Web Application Firewalls (WAFs) can be configured to inspect and block requests to the patch.readRepoDirectories procedure containing known shell metacharacters in the repoPath parameter, though this requires careful tuning to avoid legitimate service disruption. Regularly audit Dokploy container logs and host system logs for any signs of unusual command execution or Docker API interactions originating from the Dokploy container. The confirmed vendor fix for this vulnerability is in Dokploy version 0.29.13. All affected instances must be updated to this version or higher immediately to remediate the flaw.

Related Vulnerabilities

CVE-2026-78312: Path Traversal in DIAEnergie

CVE-2026-81549: IBM DataStage on Cloud Pak for Data 5

CVE-2026-97360: HFS2 Unauthenticated Arbitrary File Access Leads to Full Host Compromise

TheHackerWire Threat Intel Team