CVE-2026-45661
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedDokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.5 and earlier, a critical path traversal vulnerability exists in Dokploy v0.26.5 that allows authenticated users to write arbitrary files to the filesystem during application deployment. When combined with Dokploy's remote server deployment feature, this vulnerability enables arbitrary file write to remote server filesystems, automatic remote code execution via cron jobs, complete server compromise, data exfiltration without user interaction, and persistent backdoor installation. This vulnerability bypasses all container isolation on remote server deployments.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceA path traversal vulnerability in Dokploy v0.26.5 and earlier allows authenticated users to write arbitrary files to the filesystem during application deployment. This vulnerability specifically impacts the remote server deployment feature, enabling attackers to write files to remote server filesystems, achieve RCE via cron job injection, and establish persistent backdoors while bypassing container isolation.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Check Dokploy versionLocate the installed Dokploy version by inspecting the application UI, checking the Docker container label, or running 'docker ps' to identify the image tag version. If using a self-hosted installation, check the package.json or package version file in the Dokploy installation directory.Affected if The installed version is before 0.26.6 (any 0.x.x version below 0.26.6)
-
Verify remote server deployment feature statusCheck if any remote servers are configured in Dokploy by navigating to the server settings panel or inspecting the database configuration table that stores server connection details. Look for any active remote server deployments.Affected if Remote server deployments are configured and the Dokploy version is vulnerable
-
Inspect deployment directory for unexpected filesReview the application deployment directories on the local and remote servers. Compare the file structure against the expected deployment manifest. Look for files in parent directories or outside the designated deployment root path.Affected if Files exist outside the intended deployment directory or unexpected files appear in parent directories
-
Examine cron jobs for injectionOn remote servers configured for deployment, list all cron jobs using 'crontab -l' and inspect /etc/cron.d/ and /var/spool/cron/ directories. Check for unfamiliar scheduled tasks, especially those pointing to scripts in deployment directories or executing shell commands.Affected if Unrecognized cron jobs exist, particularly those executing scripts from application deployment directories or containing suspicious shell commands
You are affected if Dokploy version is below 0.26.6 AND remote server deployments are configured, as the path traversal allows writing arbitrary files to remote filesystems leading to potential RCE.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataUpgrade to a patched version of Dokploy beyond 0.26.5 and implement strict path validation/sanitization on all deployment file-write operations to prevent traversal sequences.
- Consultation6.0 h
- Implementation12.0 h
- Testing8.0 h
- Review / QA6.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $9,024.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-45661 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-45661 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data