Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-45406

Dokku is a docker-powered PaaS. Prior to 0.38.2, the openresty-vhosts plugin copies files from an app's openresty/http-includes/ git repository directory to the host and then interpolates their filenames, unescaped, into a single-quoted shell string that is later parsed by eval. A filename containing a single quote breaks the quoting and allows command substitution to execute arbitrary commands on the host as the dokku user during the app's next deploy. This vulnerability is fixed in 0.38.2.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:092061df5e18b0c3b84a4131e144cd9f259fe71915876d72901d9718fcfc14c3
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"dokku","vendor":"dokku","versions":[{"status":"affected","version":"< 0.38.2"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:d78276dafb21fbf2e299a978d6bc092aafb92b67c251b029ae82b7452de316bc · sha256:70c4b64ed2c35421… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:d78276dafb21fbf2e299a978d6bc092aafb92b67c251b029ae82b7452de316bc · sha256:70c4b64ed2c35421… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-95","description":"CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:d78276dafb21fbf2e299a978d6bc092aafb92b67c251b029ae82b7452de316bc · sha256:70c4b64ed2c35421… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions
{"name":"https://github.com/dokku/dokku/pull/8588","tags":["x_refsource_MISC"],"url":"https://github.com/dokku/dokku/pull/8588"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:d78276dafb21fbf2e299a978d6bc092aafb92b67c251b029ae82b7452de316bc · sha256:70c4b64ed2c35421… · /containers/cna/references/1
{"name":"https://github.com/dokku/dokku/security/advisories/GHSA-ggqh-98fj-8mg9","tags":["x_refsource_CONFIRM"],"url":"https://github.com/dokku/dokku/security/advisories/GHSA-ggqh-98fj-8mg9"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:d78276dafb21fbf2e299a978d6bc092aafb92b67c251b029ae82b7452de316bc · sha256:70c4b64ed2c35421… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer