CVE-2026-72736 in Dokploy
Summary
by MITRE • 08/10/2026
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy passes user-controlled values directly into shell commands via unquoted template literal interpolation in the registry credential testing and Docker Swarm cluster management endbpoints. Both endpoints have a safe local code path (using execFileAsync or the Docker API) but a vulnerable remote path (using execAsyncRemote which runs the shell string via SSH). This vulnerability is fixed in 0.29.13.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
Dokploy represents a self-hostable Platform as a Service solution that enables users to deploy and manage applications without relying on external cloud providers. The platform operates through both local and remote execution paths, with the vulnerable versions containing a critical security flaw in how user inputs are processed within specific endpoint handlers. This vulnerability specifically affects the registry credential testing functionality and Docker Swarm cluster management components, creating a potential attack surface that could be exploited by malicious actors.
The technical flaw manifests through improper handling of user-controlled data within template literal interpolations that are subsequently executed as shell commands. The application employs unquoted string interpolation patterns that directly incorporate user-supplied values into command execution contexts without adequate sanitization or validation. When these endpoints process requests, they construct shell commands using the vulnerable execAsyncRemote function which executes these constructed strings over SSH connections to remote systems. This approach creates a classic command injection vulnerability where attacker-controlled input can be interpreted and executed as shell commands within the target environment.
The operational impact of this vulnerability extends beyond simple code execution as it enables attackers to potentially gain unauthorized access to underlying infrastructure resources, manipulate container deployments, or escalate privileges within the Docker Swarm clusters managed by Dokploy. The remote execution path through SSH connections amplifies the risk significantly since successful exploitation could allow adversaries to execute arbitrary commands on systems that are typically protected by network segmentation and access controls. This vulnerability affects both local development environments and production deployments where remote management capabilities are enabled.
Security standards such as CWE-78 and CWE-88 directly apply to this scenario, with CWE-78 specifically addressing "Improper Neutralization of Special Elements used in an OS Command" and CWE-88 covering "Command Line Injection." The vulnerability also maps to ATT&CK technique T1059.004 which describes "Command and Scripting Interpreter: PowerShell," though the actual execution occurs through shell commands rather than PowerShell specifically. Organizations utilizing Dokploy versions prior to 0.29.13 face significant risk of unauthorized system compromise, data exfiltration, or service disruption. The fix implemented in version 0.29.13 addresses this by ensuring proper sanitization and validation of user inputs before their inclusion in shell command execution contexts, thereby preventing the injection of malicious commands through the vulnerable remote code paths.
Mitigation strategies should prioritize immediate upgrade to version 0.29.13 or later while implementing additional security controls such as network segmentation between management interfaces and production systems. Organizations should also consider implementing input validation layers at multiple points within their deployment pipelines, particularly focusing on endpoints that handle user-provided configuration data for registry credentials and cluster management operations. Regular security assessments of third-party components and dependency updates should be conducted to prevent similar vulnerabilities from emerging in other parts of the application stack.