CVE-2026-72872
Received Received - Intake

Remote Code Execution in Dokploy PaaS

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, application.saveBitbucketProvider stores bitbucketOwner and bitbucketRepository without validation and cloneBitbucketRepository in packages/server/src/utils/providers/bitbucket.ts interpolates those values into git clone commands executed through execAsync or execAsyncRemote, allowing a member with service deployment permission to execute arbitrary operating system commands on the Dokploy host or target server. This issue is fixed in version 0.29.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-11
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-72872
EUVD
EUVD-2026-55733

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dokploy dokploy 0.29.13

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Dokploy before version 0.29.13 allows a user with service deployment permissions to execute arbitrary operating system commands on the Dokploy host or target server. It occurs because unvalidated inputs (bitbucketOwner and bitbucketRepository) are interpolated into git clone commands via execAsync or execAsyncRemote functions.

Detection Guidance

Check Dokploy version with 'dokploy --version'. If it is below 0.29.13, the system is vulnerable. Review logs for unexpected git clone commands or unusual activity in application.saveBitbucketProvider.

Impact Analysis

An attacker with deployment permissions could gain full control over the server running Dokploy or the target server where applications are deployed. This could lead to data theft, system compromise, or disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access control. Organizations using affected versions may face compliance violations and legal consequences.

Mitigation Strategies

Upgrade Dokploy to version 0.29.13 or later immediately. Restrict service deployment permissions to trusted members only. Monitor for unauthorized command execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72872. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart