CVE-2026-72738 in Dokploy
Summary
by MITRE • 08/10/2026
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.listBackupFiles tRPC endpoint in apps/dokploy/server/api/routers/backup.ts passes the search parameter through normalizeS3Path and interpolates it into an rclone lsjson command executed by child_process.exec(), allowing an authenticated user with backup:read permission to execute arbitrary commands on the Dokploy host. This issue is fixed in version 0.29.13.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability identified in Dokploy versions prior to 0.29.13 represents a critical command injection flaw within the backup management functionality of this self-hostable PaaS solution. The affected component resides in the apps/dokploy/server/api/routers/backup.ts file where the backup.listBackupFiles tRPC endpoint processes user-provided search parameters without adequate sanitization or validation. This endpoint specifically utilizes the normalizeS3Path function to process input before passing it to an rclone lsjson command executed via child_process.exec(), creating a direct path for arbitrary code execution on the host system.
The technical implementation of this vulnerability stems from improper input handling within the backup listing functionality, where user-supplied search terms are directly interpolated into system commands without proper escaping or parameterization. The normalizeS3Path function, while designed to process S3 paths, fails to adequately sanitize the search parameter for command execution contexts. When an authenticated user with backup:read permissions invokes the listBackupFiles endpoint, their input becomes part of the rclone command string, enabling malicious actors to inject additional commands that execute with the privileges of the Dokploy service account on the host system.
This vulnerability presents significant operational impact as it allows authenticated attackers to achieve arbitrary code execution on the server hosting the Dokploy platform. The attack surface is limited to users who possess backup:read permissions, but this access level is typically sufficient for administrative tasks and could be obtained through legitimate means or privilege escalation within the system. Once exploited, the attacker gains full control over the host environment including potential access to other applications, databases, and system resources that may be running on the same infrastructure.
The security implications extend beyond immediate command execution to encompass potential lateral movement and persistence within the compromised environment. According to CWE classification, this vulnerability maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, which specifically addresses the dangerous practice of directly interpolating user input into operating system commands. From an ATT&CK framework perspective, this represents a privilege escalation technique through command injection, potentially enabling further reconnaissance and exploitation activities. The fix implemented in version 0.29.13 likely involves proper input sanitization or parameterization of the rclone command execution to prevent user-controllable data from being interpreted as command syntax rather than literal path parameters.
Organizations utilizing Dokploy should immediately upgrade to version 0.29.13 or later to remediate this vulnerability, while also implementing additional monitoring for unusual backup listing activities that might indicate exploitation attempts. System administrators should review access controls to ensure that backup:read permissions are granted only to trusted users and consider implementing additional security measures such as command whitelisting or sandboxed execution environments for external tool integrations like rclone. The vulnerability highlights the critical importance of input validation and proper command construction practices when integrating third-party tools into application frameworks, particularly in PaaS environments where service accounts may possess elevated privileges.