CVE-2026-72877

Received Received - Intake

Command Injection in Dokploy Self-Hosted PaaS

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the dockerImage field is interpolated without quoting into shell commands in buildRemoteDocker() in packages/server/src/utils/providers/docker.ts and is validated only as an optional string. An authenticated user with application create or update permission can use shell command substitution in dockerImage to execute arbitrary commands on the local build host or a remote SSH build target, exposing host secrets and other projects. This issue is fixed in version 0.29.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-72877

EUVD

EUVD-2026-55742

Affected Vendors & Products

Vendor	Product	Version / Range
dokploy	dokploy	0.29.13

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

Dokploy before 0.29.13 has an issue where the dockerImage field is inserted into shell commands without proper quoting. An authenticated user with application create or update permissions can use shell command substitution in dockerImage to execute arbitrary commands on the local build host or remote SSH targets. This allows exposure of host secrets and other projects.

Detection Guidance

Check Dokploy version for 0.29.13 or higher. Inspect buildRemoteDocker() in packages/server/src/utils/providers/docker.ts for unquoted dockerImage field usage. Monitor system logs for unexpected command execution during builds.

Impact Analysis

An attacker with limited access could escalate privileges to run arbitrary commands on the host system or remote targets. This could lead to data theft, unauthorized access to other projects, or compromise of the entire build infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Compliance may be compromised due to potential exposure of sensitive data.

Mitigation Strategies

Upgrade Dokploy to version 0.29.13 or later immediately. Review and restrict application create/update permissions for users. Audit recent build logs for suspicious activity. Consider temporary isolation of build environments.

Hi! I’m here to help you understand CVE-2026-72877. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70