ETK-2026-4260Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-4260",
  "cve_id": null,
  "display_id": "ETK-2026-4260",
  "ghsa_id": "GHSA-2w53-7ppr-3xpp",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Authorization bypass and command injection in Dokploy backups",
  "summary": "Dokploy backup and restore functionality can fail to enforce ownership and administrative authorization for certain backup types and destinations. An authenticated member may access or alter backup operations, obtain sensitive backup contents, disrupt restores, or cause commands to run through improperly handled backup metadata.",
  "mitigation": "Upgrade Dokploy to version 0.31.1 or later. Until upgraded, remove untrusted member accounts and limit access to backup, restore, and backup-destination operations to trusted administrators.",
  "vendor": "other",
  "product": "dokploy",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 0.31.1"
      ],
      "ecosystem": "other",
      "fixed_versions": [
        "0.31.1"
      ],
      "package_name": "dokploy",
      "purl": null
    }
  ],
  "cwes": [
    78
  ],
  "cvss_score": 9.9,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 29.0350669,
  "t0_at": null,
  "signals": {
    "public_poc": {
      "at": "2026-11-12T08:15:40+00:00",
      "days": -0.23608210626157408,
      "is_lower_bound": true,
      "measured_at": "2026-11-12T13:55:37.563084+00:00",
      "url": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-2w53-7ppr-3xpp"
    },
    "trigger_signal": {
      "at": "2026-11-12T08:15:40+00:00",
      "days": -0.23608210626157408,
      "is_lower_bound": true,
      "measured_at": "2026-11-12T13:55:37.563084+00:00",
      "url": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-2w53-7ppr-3xpp"
    }
  }
}