CVE-2026-72868 in Dokploy
Summary
by MITRE • 08/10/2026
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, apps/dokploy/server/api/routers/destination.ts interpolates the accessKey, secretAccessKey, region, endpoint, provider, and bucket fields from destination.testConnection into an rclone ls command executed through child_process.exec. The `withPermission("destination", "create")` path permits a low-privileged organization member to reach the mutation, close a quoted argument with a crafted field, and execute arbitrary commands in the root Dokploy container, which has access to the host Docker socket. This issue is fixed in version 0.29.13.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability exists within Dokploy's destination test connection functionality where user-provided input values are directly interpolated into an rclone command executed via child_process.exec without proper sanitization or escaping. The flaw occurs in the apps/dokploy/server/api/routers/destination.ts file where accessKey, secretAccessKey, region, endpoint, provider, and bucket fields from the destination.testConnection payload are concatenated into an rclone ls command. This represents a classic command injection vulnerability that allows arbitrary code execution through improper input handling.
The security implications are severe as the vulnerability can be exploited by low-privileged organization members who have access to the create destination mutation. Through careful crafting of input values, attackers can close quoted arguments and inject malicious commands that execute within the root Dokploy container context. This container operates with elevated privileges including access to the host Docker socket, which provides attackers with complete control over the underlying infrastructure and potentially all running containers on the system. The vulnerability directly maps to CWE-78, which describes improper neutralization of special elements used in OS commands, and CWE-94, which covers improper control of generation of code.
The operational impact extends beyond simple command execution as the compromised container can leverage its access to the Docker socket to manipulate or extract data from all containers running on the host system. This creates a significant risk for organizations using Dokploy as their self-hosted PaaS solution since a single compromised low-privileged account can lead to complete system compromise. The attack vector demonstrates how insufficient input validation and sanitization in API endpoints can create critical security gaps even when access controls appear to be properly implemented.
Mitigation strategies should focus on implementing proper input sanitization and escaping for all user-provided values that are used in system commands. The recommended approach involves using parameterized command execution rather than string interpolation, ensuring that special characters are properly escaped or quoted, and avoiding direct execution of user-supplied data through child_process.exec. Organizations should also implement stricter access controls and audit logging to detect unauthorized attempts to exploit such vulnerabilities. The fix implemented in version 0.29.13 likely includes proper input validation and command construction methods that prevent the injection of malicious commands through the destination test connection functionality, aligning with ATT&CK technique T1059.001 for command and script injection while addressing the specific CWE-78 vulnerability through proper input sanitization practices.