Miembros de
Boletines de Vulnerabilidades |
CVE-2025-53376 |
|
| Software afectado | DOCKER |
|
Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated, low-privileged user can run arbitrary OS commands on the Dokploy host. The tRPC procedure docker.getContainersByAppNameMatch interpolates the attacker-supplied appName value into a Docker CLI call without sanitisation, enabling command injection under the Dokploy service account. This vulnerability is fixed in 0.23.7. |
|
Link: |
|
| https://nvd.nist.gov/vuln/detail/CVE-2025-53376 | |
