CyberRota Analysis
AI-GeneratedDokploy versions 0.29.3 to 0.29.12 are vulnerable due to inadequate server-side validation of branch fields, allowing low-privileged authenticated users to execute arbitrary commands on the host through malicious Git branch inputs. This critical vulnerability poses a significant risk to systems using Dokploy, particularly those integrated with GitLab and GitHub. Organizations utilizing these affected versions should prioritize immediate updates to version 0.29.13 to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch, branch, gitlabBranch, bitbucketBranch, or giteaBranch. A low-privileged authenticated user can trigger compose.deploy, which passes the stored branch to shell-based Git clone commands in packages/server/src/utils/providers/git.ts, github.ts, gitlab.ts, bitbucket.ts, and gitea.ts, resulting in arbitrary host command execution. This issue is fixed in version 0.29.13.