CVE-2026-72867
Received Received - Intake

Command Injection in Dokploy Self-Hosted PaaS

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch, branch, gitlabBranch, bitbucketBranch, or giteaBranch. A low-privileged authenticated user can trigger compose.deploy, which passes the stored branch to shell-based Git clone commands in packages/server/src/utils/providers/git.ts, github.ts, gitlab.ts, bitbucket.ts, and gitea.ts, resulting in arbitrary host command execution. This issue is fixed in version 0.29.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-11
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-72867
EUVD
EUVD-2026-55725

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dokploy dokploy to 0.29.13 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-602 The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Dokploy, a self-hostable PaaS, between versions 0.29.3 and 0.29.13. It allows low-privileged authenticated users to execute arbitrary host commands via a malicious branch name stored in compose settings. The incomplete fix for CVE-2026-45628 failed to add server-side validation for branch fields, enabling command injection through Git clone operations.

Detection Guidance

Check Dokploy versions between 0.29.3 and 0.29.12 for the incomplete fix. Inspect compose.update requests for malicious customGitBranch or branch values. Review shell-based Git clone commands in providers for unexpected inputs.

Impact Analysis

An attacker with low privileges could exploit this to run arbitrary commands on the host system where Dokploy is deployed. This could lead to full system compromise, data theft, or unauthorized access to other services running on the same host.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements. For HIPAA, it risks exposing protected health information, potentially breaching security and privacy rules. Compliance failures may result in legal penalties and reputational damage.

Mitigation Strategies

Upgrade Dokploy to version 0.29.13 or later immediately. Remove any untrusted customGitBranch or branch values from compose configurations. Restrict low-privileged user access to compose.update and compose.deploy functions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72867. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart