CVE-2026-72862 in Dokploy
Summary
by MITRE • 08/10/2026
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts Dokploy database service deployment functions pass user-controlled dockerImage fields unquoted into docker pull ${dockerImage} shell commands on the remote-server code path. This vulnerability is fixed in 0.29.13.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability exists within Dokploy, a self-hostable Platform as a Service solution, where multiple database service deployment functions suffer from improper input validation and command construction. The flaw affects mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts files that handle database service deployments. These functions directly incorporate user-provided dockerImage values into shell commands without proper sanitization or quoting mechanisms, creating a critical security risk.
The technical implementation involves the execution of unquoted shell commands through the pattern docker pull ${dockerImage} where the dockerImage variable contains user-controlled input. This primitive command injection vulnerability allows attackers to manipulate the docker pull command execution by injecting malicious characters that alter the intended command behavior. When an attacker supplies a specially crafted dockerImage value containing shell metacharacters, these inputs can be interpreted by the shell as additional commands or arguments, potentially enabling arbitrary code execution on the remote server.
The operational impact of this vulnerability extends beyond simple command injection as it provides attackers with potential access to the underlying server infrastructure. Since the vulnerable functions execute on the remote server code path, successful exploitation could allow adversaries to pull malicious docker images, execute arbitrary commands, or even gain full control over the hosting environment. This represents a significant escalation from typical application-level vulnerabilities to system-level compromise opportunities.
The vulnerability aligns with CWE-78, which specifically addresses OS Command Injection, and manifests as a direct consequence of improper input validation in shell command construction. From an adversarial perspective, this flaw maps to ATT&CK technique T1059.004 for Command and Scripting Interpreter: PowerShell, though the implementation here uses standard shell commands rather than PowerShell directly. The vulnerability also relates to broader security principles around input sanitization and secure coding practices as outlined in OWASP Top Ten categories.
Mitigation strategies should include immediate deployment of version 0.29.13 which addresses this specific command injection flaw through proper quoting and sanitization of user-controlled inputs. Organizations should implement strict input validation measures where all dockerImage values undergo comprehensive sanitization before being incorporated into shell commands. Additionally, the codebase should adopt secure coding practices that enforce proper shell escaping or utilize direct API calls to docker instead of shell command execution for improved security posture and reduced attack surface.