CVE-2026-72735 in Dokploy
Summary
by MITRE • 08/10/2026
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed through execAsyncRemote. Single quotes in redirect regex and replacement fields, basic authentication usernames, domain host values, or middleware configuration can terminate the shell quoting and execute arbitrary commands on managed remote servers with the configured SSH user's privileges. This vulnerability is caused by an incomplete fix for CVE-2026-45630. This issue is fixed in version 0.29.13.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability identified in Dokploy versions prior to 02913 represents a critical command injection flaw that arises from improper handling of user-controlled input within the Traefik configuration processing pipeline. The core issue exists in the writeTraefikConfigRemote function located within packages/server/src/utils/traefik/application.ts, where user-provided data flows through yaml.stringify serialization before being interpolated into shell commands executed via execAsyncRemote. This architectural weakness creates a direct path for remote attackers to execute arbitrary code on managed servers with the privileges of the configured SSH user, fundamentally compromising the security posture of self-hosted deployments.
The technical flaw stems from inadequate input sanitization and shell command construction practices that fail to properly escape or quote user-controlled data before incorporating it into shell contexts. When users provide configuration values such as redirect regex patterns, replacement strings, basic authentication usernames, domain host specifications, or middleware configurations, single quotes within these inputs can prematurely terminate shell quoting mechanisms. This allows attackers to inject malicious shell commands that execute with the privileges of the SSH user, potentially enabling full system compromise of remote servers running Dokploy managed services.
This vulnerability directly maps to CWE-78 and CWE-88 within the Common Weakness Enumeration framework, specifically addressing improper neutralization of special elements used in shell commands and command injection flaws. The issue also aligns with ATT&CK technique T1059.001 (Command and Scripting Interpreter: PowerShell) and T1059.004 (Command and Scripting Interpreter: Unix Shell), as it enables adversaries to execute arbitrary commands through shell interpretation. The incomplete fix for CVE-2026-45630 suggests that previous remediation efforts were insufficient, leaving the system vulnerable to similar injection patterns in different code paths.
The operational impact of this vulnerability extends beyond simple command execution, as successful exploitation could enable attackers to escalate privileges, establish persistent access, exfiltrate sensitive data, or compromise other systems within the deployment environment. Remote servers running Dokploy with affected versions become potential entry points for broader network infiltration, particularly when the SSH user has elevated privileges or access to critical infrastructure components. The severity is amplified by the fact that this affects self-hosted deployments where administrators may not have robust monitoring or intrusion detection in place.
Mitigation strategies should prioritize immediate upgrade to version 02913 or later, which implements proper input validation and shell escaping mechanisms. Additionally, administrators should implement network segmentation, restrict SSH access to known IP addresses, employ least privilege principles for SSH users, and establish comprehensive monitoring of shell command execution patterns. Regular security audits of configuration handling code paths and input validation mechanisms should be conducted to prevent similar vulnerabilities in future development cycles, ensuring that all user-controlled data undergoes proper sanitization before being incorporated into any system command contexts.