CVE-2026-27130
Dokploy is a free, self-hostable Platform as a Service (PaaS). Versions 0.26.6 and below have OS command injection through the appName parameter. 3 chained issues cause this problem: inadequate inp...
Affects 0 products across 2 vendors.
Attacker injects OS commands through application inputs passed to system() or equivalent calls, leading to arbitrary command execution.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
Dokploy versions 0.26.6 and below are vulnerable to OS command injection through the appName parameter due to inadequate input sanitization, lack of schema validation, and direct shell interpolation.
BSID: BS-2026-GLOBAL-075491-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2026-27130?
What is the CVSS score for CVE-2026-27130?
Is CVE-2026-27130 actively exploited?
How do I remediate CVE-2026-27130?
What systems are affected by CVE-2026-27130?
| CVE ID | CVE-2026-27130 |
|---|---|
| BSID | BS-2026-GLOBAL-075491-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| Published | 2026-05-18 |
| Last Modified | 2026-10-06 |
| ICS Relevance | 15% |
| Weakness (CWE) | |
| Source | NVD |
Dokploy is a free, self-hostable Platform as a Service (PaaS). Versions 0.26.6 and below have OS command injection through the appName parameter. 3 chained issues cause this problem: inadequate input sanitization, lack of schema validation and direct shell interpolation. User-controlled application names are passed through inadequate sanitization (cleanAppName function only replaces spaces and converts to lowercase) before being interpolated directly into shell commands executed via execAsync() and execAsyncRemote(). An authenticated attacker can inject shell metacharacters (e.g., ;, $(), backticks, |, &) in the appName field during application creation, which are then executed with server-level privileges when service operations (start, stop, remove, scale) are triggered. This issue has been resolved in version 0.26.7.
Source: NIST NVD / MITRE CVE Database
An attacker can exploit this vulnerability by injecting malicious commands into the appName parameter. The cleanAppName function only replaces spaces and certain characters, which is insufficient to prevent command injection. This allows the attacker to execute arbitrary commands on the server.
Exploitation Likelihood: CRITICAL
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
AI Enrichment Record — provenance & audit hash
| Model | /workspace/models/qwen2.5-coder-32b-instruct-bf16 |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 39450e325937c835ec515580792fc1d7a929ab63f4b4148637e1cc684365bea58b58c46f916039af29d572a4703b6c3b1e66e3ba83a50f68eae9ad5dc128173a |
Critical Severity - Know Your Exposure
A CVSS 9.9 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →