Vulnerability · Published Jul 7, 2025 · Assigned by GitHub_M

CVE-2025-53376Dokploy allows attackers to run arbitrary OS commands on the Dokploy host.

Medium 6.3

In plain English

A medium-severity OS command injection in dokploy from Dokploy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).

Severity (CVSS 4.0)6.3Medium

Exploit odds (30 days)1.1%top 34.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated, low-privileged user can run arbitrary OS commands on the Dokploy host. The tRPC procedure docker.getContainersByAppNameMatch interpolates the attacker-supplied appName value into a Docker CLI call without sanitisation, enabling command injection under the Dokploy service account. This vulnerability is fixed in 0.23.7.

Affected products (as reported)

Vendor	Product	Versions
Dokploy	dokploy	< 0.23.7

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

References

https://github.com/Dokploy/dokploy/security/advisories/GHSA-m486-7pmj-8cmv x_refsource_CONFIRM
https://github.com/Dokploy/dokploy/commit/fb5d2bd5b67322f1468e5e4d0d5abcf97517761c x_refsource_MISC