| Package | Affected versions | Patched versions |
|---|---|---|
| dokploy | < 0.23.7 | 0.23.7 |
Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated, low-privileged user can run arbitrary OS commands on the Dokploy host. The tRPC procedure docker.getContainersByAppNameMatch interpolates the attacker-supplied appName value into a Docker CLI call without sanitisation, enabling command injection under the Dokploy service account. This vulnerability is fixed in 0.23.7.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free