CVE-2026-72740 in Dokploy
Summary
by MITRE • 08/10/2026
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, packages/server/src/utils/providers/git.ts parses the user-controlled customGitUrl with sanitizeRepoPathSSH and interpolates its domain into the ssh-keyscan command from addHostToKnownHostsCommand without shell quoting, allowing an authenticated member with service deployment permission and an attached SSH key to execute arbitrary commands on the Dokploy host during deployment. This issue is fixed in version 0.29.13.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability in Dokploy affects versions prior to 0.29.13 and represents a critical command injection flaw within the Git repository handling functionality of this self-hostable PaaS platform. The issue stems from improper input validation and sanitization in the packages/server/src/utils/providers/git.ts file where user-provided customGitUrl values are processed through the sanitizeRepoPathSSH function. This function fails to properly escape or quote the domain component when interpolating it into the ssh-keyscan command executed during the addHostToKnownHostsCommand process.
The technical exploitation of this vulnerability occurs through authenticated access with service deployment permissions and an attached SSH key, creating a privilege escalation vector that allows attackers to execute arbitrary commands on the host system during deployment operations. The root cause lies in the lack of proper shell escaping for user-controlled input within the command construction process, directly violating security principles outlined in CWE-78 and CWE-88. This vulnerability enables an attacker to inject malicious commands into the ssh-keyscan execution context, potentially leading to complete system compromise.
The operational impact of this vulnerability extends beyond simple command execution, as it allows attackers to escalate privileges and gain unauthorized access to the underlying host infrastructure where Dokploy is deployed. Attackers can leverage this weakness to install backdoors, exfiltrate sensitive data, or establish persistent access to the deployment environment. The attack vector requires minimal prerequisites since authenticated users with deployment permissions already possess the necessary credentials to initiate the vulnerable code path.
Mitigation strategies should focus on implementing proper input sanitization and shell escaping mechanisms for all user-controlled inputs that are subsequently interpolated into system commands. The fix implemented in version 0.29.13 addresses this by ensuring that domain components from customGitUrl are properly quoted when passed to the ssh-keyscan command, preventing command injection attacks. Organizations should also consider implementing additional security controls such as input validation, privilege separation, and monitoring for suspicious deployment activities. This vulnerability aligns with ATT&CK technique T1059.001 for command and scripting interpreter and represents a classic example of insufficient input sanitization that can be addressed through proper secure coding practices and adherence to industry standards like those outlined in the OWASP Top Ten project.