CVE-2026-72870 in Dokploy
Summary
by MITRE • 08/10/2026
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the buildRemoteDocker() function in packages/server/src/utils/providers/docker.ts interpolates the application-controlled dockerImage value directly into a docker pull shell command. An authenticated user with project access can set a crafted dockerImage through application.update and trigger application.deploy, causing execAsync() to execute arbitrary operating-system commands as the Dokploy server process. This issue is fixed in version 0.29.13.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability identified in Dokploy versions prior to 029.13 represents a critical command injection flaw that undermines the security posture of this self-hostable Platform as a Service solution. This weakness exists within the buildRemoteDocker() function located in packages/server/src/utils/providers/docker.ts, where user-controllable input is directly interpolated into shell commands without adequate sanitization or validation. The flaw specifically affects the dockerImage parameter which is processed through application.update and subsequently triggers application.deploy operations, creating a pathway for authenticated attackers to execute arbitrary operating-system commands with the privileges of the Dokploy server process.
The technical implementation of this vulnerability stems from improper input handling within the Docker orchestration workflow, where the application-controlled dockerImage value flows directly into a shell command execution context. This pattern constitutes a classic command injection vulnerability that aligns with CWE-78, which specifically addresses improper neutralization of special elements used in OS commands. The flaw operates through the execAsync() function call that executes the malformed shell command, allowing attackers to manipulate the underlying system through carefully crafted dockerImage values that contain shell metacharacters and command separators.
Operational impact of this vulnerability extends beyond simple privilege escalation as it provides attackers with complete control over the Dokploy server environment. Since the exploitation requires only project access, which is typically granted to legitimate users, this creates a significant risk for organizations relying on Dokploy for containerized application deployment. Attackers could potentially execute malicious commands such as retrieving sensitive configuration files, establishing persistence mechanisms, or even compromising other services running on the same host system. The vulnerability affects the core deployment functionality and undermines the trust model of the platform, as legitimate users can be exploited to perform unauthorized operations.
Mitigation strategies for this vulnerability involve implementing proper input validation and sanitization measures that prevent shell metacharacters from being interpreted within command execution contexts. The fix implemented in version 0.29.13 addresses this by ensuring that user-provided dockerImage values are properly escaped or validated before being incorporated into shell commands. Organizations should also consider implementing principle of least privilege for the Dokploy server process, limiting its system capabilities and monitoring for unusual command executions. Additionally, regular security audits of input handling functions and proper adoption of secure coding practices such as those outlined in the OWASP Secure Coding Practices can prevent similar vulnerabilities from emerging in future development cycles. This incident highlights the importance of avoiding direct shell command construction with user-controllable data and demonstrates the necessity of following established security frameworks like the ATT&CK framework's command and control tactics when designing system components that interact with operating system interfaces.