CVE-2026-72735

Received Received - Intake

Command Injection in Dokploy Self-Hosted PaaS

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed through execAsyncRemote. Single quotes in redirect regex and replacement fields, basic authentication usernames, domain host values, or middleware configuration can terminate the shell quoting and execute arbitrary commands on managed remote servers with the configured SSH user's privileges. This vulnerability is caused by an incomplete fix for CVE-2026-45630. This issue is fixed in version 0.29.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-72735

EUVD

EUVD-2026-55681

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability in Dokploy versions before 0.29.13 allows remote command execution due to improper handling of user-controlled Traefik configuration. The flaw occurs in the writeTraefikConfigRemote function where YAML serialization and shell command interpolation fail to properly escape single quotes in fields like redirect regex, authentication usernames, or domain hosts. This enables attackers to break out of shell quoting and inject arbitrary commands.

Detection Guidance

Check Dokploy version with 'dokploy --version' or inspect server logs for Traefik configuration errors. Look for unauthorized command execution patterns in SSH logs or system audit trails.

Impact Analysis

If exploited, this vulnerability allows attackers with access to the Dokploy configuration to execute arbitrary commands on remote servers managed by the system. The impact includes potential data breaches, unauthorized system access, or complete compromise of affected servers, depending on the privileges of the SSH user configured in Dokploy.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other regulations by enabling unauthorized access to sensitive data or systems. Organizations using vulnerable versions may face legal penalties, data protection violations, and reputational damage due to potential breaches of confidentiality and integrity requirements.

Mitigation Strategies

Upgrade Dokploy to version 0.29.13 or later immediately. Review and restrict SSH user privileges on managed servers. Audit recent Traefik configurations for suspicious changes.

Hi! I’m here to help you understand CVE-2026-72735. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70