CVE-2026-72867 in Dokploy
Summary
by MITRE • 08/10/2026
Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch, branch, gitlabBranch, bitbucketBranch, or giteaBranch. A low-privileged authenticated user can trigger compose.deploy, which passes the stored branch to shell-based Git clone commands in packages/server/src/utils/providers/git.ts, github.ts, gitlab.ts, bitbucket.ts, and gitea.ts, resulting in arbitrary host command execution. This issue is fixed in version 0.29.13.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability exists within Dokploy's compose deployment functionality where inadequate server-side validation permits malicious branch names to be stored in database schema fields. This issue affects versions 0.29.3 through 0.29.13 and specifically targets the compose.ts file in packages/server/src/db/schema directory. The flaw represents a classic input validation bypass that allows untrusted data to flow directly into critical system operations without proper sanitization or verification.
The technical implementation of this vulnerability stems from the incomplete remediation of CVE-2026-45628, which left several branch-related fields in the compose schema unvalidated. These fields include customGitBranch, branch, gitlabBranch, bitbucketBranch, and giteaBranch, all of which accept user-supplied values without appropriate server-side validation. When a low-privileged authenticated user submits a compose.update request containing malicious branch data, this information gets persisted in the database and subsequently retrieved during deployment operations.
The operational impact becomes critical when the compose.deploy function is triggered, as it passes these stored branch values directly into shell-based Git clone commands located in multiple provider utility files. These include packages/server/src/utils/providers/git.ts, github.ts, gitlab.ts, bitbucket.ts, and gitea.ts, all of which execute Git operations with user-provided branch names in command-line contexts. This direct injection of unvalidated input into shell commands creates a severe arbitrary code execution vulnerability that allows attackers to execute arbitrary host commands with the privileges of the Dokploy service account.
This vulnerability aligns with CWE-78 and CWE-89, representing command injection flaws where user-controllable data is passed directly to system commands without proper sanitization. The attack pattern follows the MITRE ATT&CK framework's technique T1059.001 for command and script interpreter execution, specifically targeting shell command execution through Git operations. The low privilege requirement makes this particularly dangerous as it can be exploited by users who should not have access to system-level command execution capabilities.
The remediation in version 0.29.13 addresses the root cause by implementing comprehensive server-side validation for all branch-related fields in the compose schema. This fix ensures that any user-provided branch names undergo proper sanitization and validation before being stored, preventing malicious values from reaching the Git clone operations. Organizations should immediately upgrade to version 0.29.13 or later to mitigate this risk, while also implementing monitoring for suspicious deployment activities that might indicate exploitation attempts.