CVE-2026-72872 in Dokploy
Summary
by MITRE • 08/10/2026
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, application.saveBitbucketProvider stores bitbucketOwner and bitbucketRepository without validation and cloneBitbucketRepository in packages/server/src/utils/providers/bitbucket.ts interpolates those values into git clone commands executed through execAsync or execAsyncRemote, allowing a member with service deployment permission to execute arbitrary operating system commands on the Dokploy host or target server. This issue is fixed in version 0.29.13.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability exists within the Dokploy platform as a service implementation where insufficient input validation creates a critical command injection flaw in the Bitbucket provider integration. The vulnerability stems from the application.saveBitbucketProvider function which stores bitbucketOwner and bitbucketRepository values without proper sanitization or validation checks. These unvalidated parameters are subsequently passed to the cloneBitbucketRepository function located in packages/server/src/utils/providers/bitbucket.ts where they undergo string interpolation directly into git clone command execution contexts.
The technical exploitation occurs through the use of execAsync or execAsyncRemote functions that execute shell commands with the interpolated Bitbucket repository values, creating an environment where maliciously crafted repository names or owner parameters can inject arbitrary shell commands. This represents a classic command injection vulnerability that maps to CWE-78 and aligns with ATT&CK technique T1059.004 for command and scripting interpreter. The flaw essentially allows an attacker with service deployment permissions to escalate privileges and execute arbitrary operating system commands on the host system or target server where Dokploy is running.
The operational impact of this vulnerability is severe as it enables privilege escalation from a service deployment role to full system compromise. An authenticated user with deployment permissions can leverage this flaw to execute arbitrary code with the privileges of the Dokploy process, potentially leading to complete system takeover, data exfiltration, or further lateral movement within the network. The vulnerability affects all versions prior to 0.29.13 and represents a critical security gap that could be exploited by both internal threat actors and external attackers who gain deployment access through other means.
Mitigation strategies should focus on implementing proper input validation and sanitization for all user-provided parameters before they are used in shell command construction. The fix implemented in version 0.29.13 likely involves adding strict validation of Bitbucket owner and repository names to prevent special characters that could enable command injection. Organizations should also consider implementing principle of least privilege access controls, regular security audits of third-party integrations, and input sanitization libraries or frameworks that properly escape shell command parameters. Additionally, monitoring for unusual git clone operations or system command execution patterns can help detect exploitation attempts. The vulnerability highlights the importance of secure coding practices around shell command execution and demonstrates how seemingly innocuous parameter handling can create critical security exposure points in modern application platforms.