CVE-2026-72881

Received Received - Intake

Command Injection in Dokploy Self-Hosted PaaS

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, database backup and restore command builders in packages/server/src/utils/backups/utils.ts and packages/server/src/utils/restore/utils.ts interpolate database names, usernames, and passwords into nested shell command strings passed to child_process.exec(). An authenticated administrator with permission to create databases and configure backups can use crafted database configuration fields to execute arbitrary commands inside PostgreSQL, MariaDB, MySQL, MongoDB, or LibSQL containers, exposing database data and credentials and potentially enabling escape when a container is overprivileged. This issue is fixed in version 0.29.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-72881

EUVD

EUVD-2026-55789

Affected Vendors & Products

Vendor	Product	Version / Range
dokploy	dokploy	to 0.29.13 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

Dokploy versions before 0.29.13 have a vulnerability where database backup and restore functions improperly handle user input. The system interpolates database credentials directly into shell commands without proper sanitization, allowing authenticated administrators to inject malicious commands into database containers.

Detection Guidance

Check Dokploy version with 'dokploy --version' or inspect the server logs for backup/restore operations. Look for unusual database container activity or unexpected shell commands in logs from packages/server/src/utils/backups/utils.ts or packages/server/src/utils/restore/utils.ts.

Impact Analysis

An attacker with admin access could execute arbitrary commands inside database containers, potentially stealing sensitive data, credentials, or even escaping to the host system if containers are overprivileged. This exposes all database information and could lead to full system compromise.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA requirements for data protection and access controls. It enables unauthorized access to sensitive data, which could result in regulatory fines, data breach notifications, and loss of compliance certifications.

Mitigation Strategies

Upgrade Dokploy to version 0.29.13 or later immediately. Review and restrict database configuration permissions for administrators. Audit backup/restore configurations for suspicious entries. Monitor database containers for unauthorized command execution.

Hi! I’m here to help you understand CVE-2026-72881. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70