Security Advisory

CVE-2025-53376

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2025-07-07 15:55:34

Last updated 2025-07-07 16:14:22

Assigner GitHub_M

CVSS score not scored

State PUBLISHED

Description

Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated, low-privileged user can run arbitrary OS commands on the Dokploy host. The tRPC procedure docker.getContainersByAppNameMatch interpolates the attacker-supplied appName value into a Docker CLI call without sanitisation, enabling command injection under the Dokploy service account. This vulnerability is fixed in 0.23.7.

← Browse all CVEs View on cve.org ↗