CVE-2026-72884

Received Received - Intake

Command Injection in Dokploy Self-Hosted PaaS

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, sanitizeCommand in packages/server/src/utils/builders/compose.ts only trims whitespace and strips surrounding quotes from compose.command before exportEnvCommand and docker command interpolation, allowing an authenticated user who can update a Compose service to inject shell metacharacters and execute arbitrary commands on the Dokploy host. This issue is fixed in version 0.29.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-72884

EUVD

EUVD-2026-55794

Affected Vendors & Products

Vendor	Product	Version / Range
dokploy	dokploy	0.29.13

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

Dokploy before version 0.29.13 has a vulnerability in the sanitizeCommand function. It only removes whitespace and quotes from Compose service commands before passing them to docker commands. This allows authenticated users with permission to update a Compose service to inject shell metacharacters and run arbitrary commands on the Dokploy host system.

Detection Guidance

Check Dokploy version with: dokploy --version. If version is below 0.29.13, the system is vulnerable. Inspect Compose service configurations for unsanitized commands.

Impact Analysis

An attacker with access to update Compose services could execute malicious commands on the host running Dokploy. This could lead to full system compromise, data theft, or disruption of services. The impact depends on the host's permissions and network access.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized command execution on systems handling sensitive data. GDPR and HIPAA require strict access controls and protection against unauthorized system access. Exploitation could lead to data breaches or unauthorized system modifications.

Mitigation Strategies

Upgrade Dokploy to version 0.29.13 or later immediately. Review and sanitize all Compose service commands to prevent shell metacharacter injection.

Hi! I’m here to help you understand CVE-2026-72884. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70