Dokku vulnerabilities
We track 5 vulnerabilities in Dokku products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on October 14, 2026.
Latest Dokku vulnerabilities
- 9.0 Critical severity
dokku: Improper Neutralization of Directives in Dynamically Evaluated Code
Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin, and those strings are
- 9.9 Critical severity
dokku: Improper Neutralization of Special Elements used in an OS Command
Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system cron running as the Dokku user. An app.json cron command utilizing special shell characters - including, but not limited to, > or ; - can b
- 9.0 Critical severity
dokku: Improper Neutralization of Special Elements used in an OS Command
Dokku is a docker-powered PaaS. Prior to 0.38.2, the app name validation regex (^[a-z0-9][^/:_A-Z]*$) permits shell metacharacters. When an authenticated user pushes to a git remote with a crafted app name, the name is embedded unquoted into a bash pre-receive
- 8.8 High severity
dokku: Improper Neutralization of Directives in Dynamically Evaluated Code
Dokku is a docker-powered PaaS. Prior to 0.38.2, the openresty-vhosts plugin copies files from an app's openresty/http-includes/ git repository directory to the host and then interpolates their filenames, unescaped, into a single-quoted shell string that is la
- 8.8 High severity
dokku: Improper Link Resolution Before File Access
Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:from-archive and certs:add commands extract user-supplied tar/zip archives into temporary directories without sanitizing member paths or preventing symlink traversal. GNU tar creates symlinks during extr