CVE-2026-72865
Received Received - Intake

Command Injection in Dokploy Prior to 0.29.13

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the compose.update operation stores an unvalidated composePath that packages/server/src/utils/builders/compose.ts and packages/server/src/services/compose.ts interpolate into docker compose -f, docker stack deploy -c, and touch shell commands executed through /bin/sh -c. An authenticated member with compose write and deploy permission can supply a crafted composePath, trigger compose.deploy or startCompose, and execute arbitrary operating-system commands in the Docker-privileged Dokploy host context. This issue is fixed in version 0.29.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-11
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-72865
EUVD
EUVD-2026-55723

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dokploy dokploy to 0.29.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Dokploy before version 0.29.13 has an issue where the compose.update operation stores an unvalidated composePath. This path is used in shell commands like docker compose -f and docker stack deploy -c, which are executed with Docker privileges. An authenticated user with compose write and deploy permissions can craft a malicious composePath to execute arbitrary OS commands on the Dokploy host.

Detection Guidance

Check Dokploy version with 'dokploy --version' or via the web interface. If version is below 0.29.13, the system is vulnerable. Inspect logs for unexpected 'docker compose' or 'docker stack deploy' commands with unusual paths.

Impact Analysis

If exploited, this vulnerability allows an attacker with limited access to gain full control over the Dokploy host system. This could lead to unauthorized data access, data theft, or disruption of services running on the host. The impact is severe due to the Docker-privileged context.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR and HIPAA requirements for data protection and access control. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade Dokploy to version 0.29.13 or later immediately. Remove unnecessary user permissions for compose write and deploy actions. Monitor for suspicious activity in Docker and Dokploy logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72865. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart