CVE-2026-72733

Received Received - Intake

Command Injection in Dokploy Backup Restoration

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds database restore shell pipelines from the user-controlled databaseName and backupFile fields without safely separating them from shell syntax. packages/server/src/utils/restore/utils.ts interpolates databaseName into database-specific restore commands, while packages/server/src/utils/restore/postgres.ts and the analogous restore modules interpolate backupFile into rclone paths. An authenticated member with backup-restore permission can inject operating-system commands that execute in the Dokploy host context through execAsync or execAsyncRemote, even when no valid database container or backup file exists. This issue is fixed in version 0.29.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-72733

EUVD

EUVD-2026-55679

Affected Vendors & Products

Vendor	Product	Version / Range
dokploy	dokploy	to 0.29.13 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

Dokploy before version 0.29.13 has an OS command injection flaw in the backup.restoreBackupWithLogs tRPC subscription. It improperly handles user-controlled databaseName and backupFile inputs, allowing authenticated users with backup-restore permissions to inject shell commands that execute on the Dokploy host.

Detection Guidance

Check Dokploy version with: dokploy --version. If version is below 0.29.13, the system is vulnerable. Inspect logs for unusual shell commands or unauthorized database restore operations.

Impact Analysis

An attacker with backup-restore permissions could execute arbitrary commands on the Dokploy host, potentially leading to full system compromise, data theft, or disruption of services. This requires valid credentials but no additional privileges.

Compliance Impact

This vulnerability could lead to unauthorized access or exfiltration of sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using vulnerable versions risk non-compliance and potential fines.

Mitigation Strategies

Upgrade Dokploy to version 0.29.13 or later immediately. Remove backup-restore permissions from untrusted users until upgrade is complete. Monitor for suspicious activity in logs.

Hi! I’m here to help you understand CVE-2026-72733. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70