CVE-2026-129433 json
Dokploy before 0.31.1 OS Command Injection via Compose Backup serviceName
published 3d ago modified 22h ago also EUVD-2026-125911 , GHSA-j329-jw7j-rxjm
Unreviewed: the maintainers' own advisory
Published by the maintainers on their GitHub repository Dokploy/dokploy. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.
- cvss
- 9.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no EPSS score yet
- public exploits
- 0
- none known
Summary
Dokploy before 0.31.1 contains an OS command injection vulnerability in getComposeContainerCommand() that allows authenticated organization members to execute shell commands via the serviceName parameter. Attackers can store serviceName values with shell metacharacters through backup.create or backup.update tRPC procedures, executing commands as root when scheduled backups run and taking over the host via the mounted Docker socket.
Patch / fix
- Dokploy dokploy 0.31.1
- github.com/Dokploy/dokploy@b24006e commit
- github.com/Dokploy/dokploy#5908 pull request
- github.com/Dokploy/dokploy/releases/tag/v0.31.1 release
Is CVE-2026-129433 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| CNA | 3.1 | 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| CNA | 4.0 | 9.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Affected products
- Dokploy dokploy
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
-
github.com
/Dokploy/dokploy/pull/5908
issue-tracking, patch
-
github.com
/Dokploy/dokploy/commit/b24006e16e95a10ce3daf739d06ac783e5c70ba0
patch
-
github.com
/Dokploy/dokploy/security/advisories/GHSA-j329-jw7j-rxjm
vendor-advisory, advisory
-
github.com
/Dokploy/dokploy/blob/v0.31.0/packages/server/src/utils/backups/utils.ts#L152
technical-description
-
github.com
/Dokploy/dokploy/releases/tag/v0.31.1
release-notes
-
github.com
/Dokploy/dokploy
product
-
vulncheck.com
/advisories/dokploy-before-0.31.1-os-command-injection-via-compose-backup-servicename
third-party-advisory
Sources
- CVE List CVE-2026-129433
- NVD CVE-2026-129433
- Maintainer advisory GHSA-j329-jw7j-rxjm
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of Dokploy/dokploy published their own advisory on GitHub. Reviewed sources take precedence over it.