CVE-2026-45661: Dokploy Path Traversal Vulnerability

CVE-2026-45661 Overview

CVE-2026-45661 is a path traversal vulnerability in Dokploy, a self-hostable Platform as a Service (PaaS). The flaw affects Dokploy version 0.26.5 and earlier. Authenticated users can write arbitrary files to the filesystem during application deployment. When combined with Dokploy's remote server deployment feature, attackers can write files to remote server filesystems outside intended directories. This enables automatic remote code execution through cron jobs, full server compromise, data exfiltration, and persistent backdoor installation. The vulnerability bypasses container isolation on remote server deployments. It maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Authenticated attackers can write arbitrary files to remote servers, achieve remote code execution via cron jobs, and install persistent backdoors while bypassing container isolation.

Affected Products

Dokploy version 0.26.5
All Dokploy versions prior to 0.26.5
Dokploy instances using the remote server deployment feature

Discovery Timeline

2026-05-29 - CVE-2026-45661 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-45661

Vulnerability Analysis

The vulnerability resides in Dokploy's application deployment workflow. The deployment logic accepts user-controlled file paths without enforcing canonical path validation. An authenticated user can supply traversal sequences such as ../ within deployment payloads. The deployment process then writes attacker-supplied content to filesystem locations outside the intended project directory.

Dokploy's remote server deployment feature extends the attack surface. The same deployment routine writes files to remote target servers through the platform's deployment agent. The attacker controls both the file path and the file contents written to the remote host. This converts a local file write primitive into a remote arbitrary file write across managed hosts.

Writing to locations such as /etc/cron.d/, /etc/cron.hourly/, or user-controlled SSH authorized_keys files produces code execution. Cron processes execute attacker-written job files automatically. The vulnerability bypasses container isolation because remote server deployments write directly to the host filesystem rather than into an isolated container layer.

Root Cause

The root cause is improper validation of file paths supplied during deployment [CWE-22]. The deployment handler does not normalize paths, reject traversal sequences, or restrict writes to a sandboxed base directory. Path components such as .. resolve outside the intended target, allowing arbitrary write locations.

Attack Vector

The attack requires authenticated access to a Dokploy instance with deployment privileges. The attacker creates or modifies an application deployment and supplies a manipulated path containing traversal sequences. Dokploy writes attacker-controlled content to the resolved location on the target server. No user interaction is required after the deployment is triggered.

The vulnerability is described in the Dokploy GitHub Security Advisory GHSA-66v7-g3fh-47h3. No verified exploit code is published. The vulnerability mechanism is documented in prose only.

Detection Methods for CVE-2026-45661

Indicators of Compromise

Unexpected files in cron directories such as /etc/cron.d/, /etc/cron.hourly/, or /etc/cron.daily/ on Dokploy-managed remote servers
Modifications to authorized_keys files for service or root accounts on remote deployment targets
Dokploy deployment logs containing path components with .. traversal sequences
New or modified files outside the standard Dokploy project directories on managed hosts

Detection Strategies

Audit Dokploy deployment records for filenames or paths containing ../, encoded variants, or absolute paths
Monitor the Dokploy deployment agent process for file writes outside the configured project root
Compare file integrity baselines on remote servers managed by Dokploy against known-good states
Review authentication logs for Dokploy accounts triggering unusual or high-volume deployments

Monitoring Recommendations

Enable filesystem auditing using auditd rules on /etc/cron.*, /root/.ssh/, and other sensitive paths on remote targets
Forward Dokploy application logs and remote agent logs to a centralized SIEM for correlation
Alert on cron job creation events outside of approved configuration management workflows
Track outbound network connections initiated by processes spawned from cron after Dokploy deployments

How to Mitigate CVE-2026-45661

Immediate Actions Required

Upgrade Dokploy to a version newer than 0.26.5 as soon as a patched release is available from the maintainers
Restrict Dokploy account creation and revoke deployment privileges from untrusted users
Audit cron directories and SSH authorized_keys files on all Dokploy-managed remote servers for unauthorized entries
Rotate credentials and SSH keys for remote servers managed by affected Dokploy instances

Patch Information

Refer to the Dokploy GitHub Security Advisory GHSA-66v7-g3fh-47h3 for the official fix and upgrade instructions. The advisory is the authoritative source for patched version numbers and configuration guidance.

Workarounds

Disable the remote server deployment feature until the instance is patched
Limit Dokploy access to a small set of trusted administrators using strong authentication
Place the Dokploy management interface behind a VPN or IP allowlist to reduce exposure
Run remote deployment targets with least-privilege service accounts to limit the impact of arbitrary file writes

bash

# Configuration example: restrict access to the Dokploy management UI
# Example nginx allowlist in front of Dokploy
location / {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://127.0.0.1:3000;
}