dokploy
v0.31.2Open Source Alternative to Vercel, Netlify and Heroku.
- Maintenance
- Active439 commits in 3 months · bus factor 1
- License
- OtherUnknown
- Security
- 30 advisories17 critical, 12 high, 1 medium
- Supported versions
- No scheduleendoflife.date does not track this project
38.5k stars · 3.2k forks · 829 open issues · last release 2 days ago · data checked 54 minutes ago
Security advisories
All advisories on GitHubThe 30 most recent advisories published by the maintainers: 17 critical, 12 high, 1 medium. Check the patched version against the one you run.
- criticalGHSA-pwg8-2x8c-wc2mNov 12, 2026Incomplete fix of GHSA-899j-cjwp-v4gw: serviceId lets a member reach any container (Member -> Root) over the docker WebSocket handlers
- Affected
- >= 0.29.13, <= 0.30.8
- highGHSA-qxjv-6cvh-32c6Nov 12, 2026Local privilege escalation to root: install.sh makes /etc/dokploy world-writable (0777)
- Affected
- <= 0.31.0
- criticalGHSA-22pq-hhxw-773wNov 12, 2026Authenticated Remote Code Execution via Command Injection in Schedule Task
- Affected
- < 0.29.13
- Patched in
- 0.29.13
- highGHSA-563h-6rxj-w49qNov 12, 2026Authenticated arbitrary file write in Traefik settings allows local and remote file overwrite
- Affected
- < 0.31.0
- Patched in
- 0.31.0
- criticalGHSA-9f4v-6m79-92m8Nov 12, 2026Multiple Command Injection vulnerabilities via Shell String Interpolation
- Affected
- < 0.31.1
- Patched in
- 0.31.1
- criticalGHSA-98j8-6vjr-c3xwNov 12, 2026OS Command Injection via unsanitized publishDirectory in Nixpacks build pipeline
- Affected
- < 0.31.1
- Patched in
- 0.31.1
- criticalGHSA-9932-qg8x-pr32Nov 12, 2026Authenticated RCE via Database Password Command Substitution
- Affected
- < 0.31.1
- Patched in
- 0.31.1
- highGHSA-gx7w-xwfw-w342Nov 12, 2026Command Injection via Shell String Interpolation
- Affected
- < 0.31.1
- Patched in
- 0.31.1
- highGHSA-cwhp-w8c5-2vjwNov 12, 2026Server-Side Request Forgery in AI and Monitoring Endpoints
- Affected
- < 0.31.1
- Patched in
- 0.31.1
- criticalGHSA-w9cp-jqfw-4xj9Nov 12, 2026SSH Private Key Disclosure to Unauthorized Organization Members via server.all and server.one tRPC Endpoints
- Affected
- < 0.29.13
- Patched in
- 0.29.13
- criticalGHSA-wcp5-g62q-jfr9Nov 12, 2026Path Traversal & RCE via unzipDrop and Schedules
- Affected
- < 0.31.1
- Patched in
- 0.31.1
- criticalGHSA-8m32-h7qx-8r79Nov 12, 2026RCE via Command Injection in Schedule appName
- Affected
- < 0.31.1
- Patched in
- 0.31.1
- highGHSA-p8v8-6hm2-3w67Nov 12, 2026Sensitive Credential Leakage: GitHub Authentication Token (`ghs_`) Exposed in Discord Webhook Payloads
- Affected
- < 0.31.0
- Patched in
- 0.31.0
- highGHSA-cq5q-r4h3-c83vNov 12, 2026SSRF: Custom notification endpoint takes arbitrary URL + headers — no URL/host validation
- Affected
- < 0.31.1
- Patched in
- 0.31.1
- mediumGHSA-vg9f-347r-pmqfNov 12, 2026CSRF on OAuth Authorization Endpoint
- Affected
- < 0.31.1
- Patched in
- 0.31.1
- criticalGHSA-jrg5-2gj5-h827Nov 12, 2026Non-admin organisation member can gain root on the host via an unrestricted host bind-mount
- Affected
- < 0.31.1
- Patched in
- 0.31.1
- criticalGHSA-v2pj-9x4j-7hcjNov 12, 2026Cross-organization SSH key attachment in Dokploy server update
- Affected
- < 0.31.1
- Patched in
- 0.31.1
- highGHSA-66r5-5m5f-57vgNov 12, 2026Cross-organization Git-provider secret disclosure (IDOR) via {github,gitlab,bitbucket,gitea}.one tRPC handlers
- Affected
- < 0.31.1
- Patched in
- 0.31.1
- criticalGHSA-fx4f-j8fj-2q69Nov 12, 2026Cross-organization IDOR across ~145 tRPC handlers via checkServicePermissionAndAccess / checkServiceAccess owner/admin bypass (CVE-2026-43917 missed siblings) + swarm topology
- Affected
- < 0.31.1
- Patched in
- 0.31.1
- criticalGHSA-5cvm-v3wv-2gw3Nov 12, 2026Authenticated OS command injection in Dokploy leads to root remote code execution (systemic; multiple endpoints)
- Affected
- < 0.31.1
- Patched in
- 0.31.1
- highGHSA-j7vw-q729-gm8mNov 12, 2026Authenticated Server-Side Request Forgery in Dokploy via the AI provider `getModels` endpoint
- Affected
- < 0.31.1
- Patched in
- 0.31.1
- highGHSA-wm5j-x54v-3fjfNov 12, 2026OS Command Injection in scheduler execution, Traefik config write, and Compose deployment → HOST RCE
- Affected
- < 0.29.13
- Patched in
- 0.29.13
- highGHSA-fgh8-p4fg-jc8hNov 12, 2026Path Traversal + OS Command Injection in mount/patch-repo/schedule services → rm -rf / + HOST RCE
- Affected
- < 0.31.1
- Patched in
- 0.31.1
- criticalGHSA-qh9m-682j-9fqrNov 12, 2026Authenticated OS command injection in database backup/restore → root RCE (v0.29.8)
- Affected
- < 0.31.1
- Patched in
- 0.31.1
- criticalGHSA-5qmc-4xhw-j6vpNov 12, 2026Traefik rule injection via unsanitized host and path fields — cross-tenant traffic hijack
- Affected
- < 0.31.1
- Patched in
- 0.31.1
- criticalGHSA-xmmr-fhf3-cwwjNov 12, 2026Authenticated Remote Code Execution and Host Escape via Command Injection in Dokploy Domain Management ServiceName Field
- Affected
- < 0.30.0
- Patched in
- 0.30.0
- highGHSA-22qj-9936-gq2mNov 12, 2026Remote deployment failures expose environment secrets in Dokploy container logs
- Affected
- < 0.31.0
- Patched in
- 0.31.0
- highGHSA-g6rj-m32j-2mc4Nov 12, 2026Arbitrary File Read via Path Traversal in `patch.readRepoFile`
- Affected
- < 0.31.1
- Patched in
- 0.31.1
- criticalGHSA-phrr-h3mm-9vp6Nov 12, 2026Path Traversal + Command Injection in Patch Application (`generateApplyPatchesCommand`)
- Affected
- < 0.31.1
- Patched in
- 0.31.1
- criticalGHSA-h542-rh5v-qgj2Nov 12, 2026[CWE-78] Authenticated Shell Command Injection via Patch Repository Path in Dokploy
- Affected
- < 0.31.1
- Patched in
- 0.31.1