CVE-2026-72733 in Dokploy
Summary
by MITRE • 08/10/2026
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds database restore shell pipelines from the user-controlled databaseName and backupFile fields without safely separating them from shell syntax. packages/server/src/utils/restore/utils.ts interpolates databaseName into database-specific restore commands, while packages/server/src/utils/restore/postgres.ts and the analogous restore modules interpolate backupFile into rclone paths. An authenticated member with backup-restore permission can inject operating-system commands that execute in the Dokploy host context through execAsync or execAsyncRemote, even when no valid database container or backup file exists. This issue is fixed in version 0.29.13.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability identified in Dokploy versions prior to 029.13 represents a critical command injection flaw that compromises the integrity of the platform's backup restoration functionality. This security weakness stems from improper input sanitization within the backup.restoreBackupWithLogs tRPC subscription handler, which processes user-provided database names and backup file paths without adequate shell escaping mechanisms. The vulnerability exists at multiple layers of the application's restore pipeline where user-controllable parameters are directly interpolated into system commands without proper contextual separation.
The technical implementation of this flaw occurs in the server-side utility functions located at packages/server/src/utils/restore/utils.ts where the databaseName parameter is directly inserted into database-specific restoration commands. Additionally, the postgres.ts module and corresponding restore modules in packages/server/src/utils/restore/ demonstrate similar unsafe interpolation patterns when handling the backupFile parameter within rclone path constructions. These interpolations create predictable attack vectors where maliciously crafted input can manipulate shell command execution contexts through the execAsync or execAsyncRemote functions that operate within the Dokploy host environment.
The operational impact of this vulnerability extends beyond simple privilege escalation as it allows authenticated users with backup-restore permissions to execute arbitrary operating system commands with the privileges of the Dokploy service account. This represents a severe privilege escalation vector since the restored backup functionality typically requires elevated permissions to access database containers and file systems. Attackers can leverage this vulnerability to gain persistent access to the host environment, potentially leading to complete compromise of the platform's infrastructure.
This vulnerability maps directly to CWE-78, which specifically addresses Improper Neutralization of Special Elements used in OS Commands, and aligns with ATT&CK technique T1059.001 for Command and Scripting Interpreter. The attack surface is particularly concerning as it requires only authenticated access with specific permissions rather than administrative privileges, making it accessible to users who should normally have limited control over system-level operations. The fix implemented in version 0.29.13 addresses this by introducing proper shell argument separation and input validation mechanisms that ensure user-provided parameters cannot influence command structure.
Security practitioners should prioritize immediate patching of affected installations while implementing additional monitoring for suspicious backup restoration activities. The vulnerability demonstrates the importance of secure coding practices around shell command construction, particularly when handling user-controllable data. Organizations utilizing Dokploy should conduct comprehensive security assessments of their backup infrastructure and consider implementing additional access controls to limit the scope of users who can perform backup restoration operations, thereby reducing the potential impact of similar vulnerabilities in other components of the platform's architecture.