CVE-2026-72874 in Dokploy
Summary
by MITRE • 08/10/2026
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, cloneGitRepository in packages/server/src/utils/providers/git.ts interpolates customGitUrl and customGitBranch into a git clone command passed to execAsync or execAsyncRemote, allowing an authenticated user with application access to execute arbitrary operating system commands on the Dokploy host by setting a malicious custom Git URL and triggering deployment. This issue is fixed in version 0.29.13.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability exists within the Dokploy platform's git repository cloning functionality where the application fails to properly sanitize user-supplied input before incorporating it into system commands. The flaw resides in the cloneGitRepository function located in packages/server/src/utils/providers/git.ts which directly interpolates customGitUrl and customGitBranch parameters into a git clone command without adequate validation or escaping mechanisms. This represents a classic command injection vulnerability that allows attackers to execute arbitrary operating system commands on the host system where Dokploy is running.
The technical implementation of this vulnerability leverages the fact that the application uses execAsync or execAsyncRemote functions to execute shell commands, with user-provided git URLs and branch names being directly embedded into these commands. An authenticated user with access to create or modify applications can manipulate the customGitUrl field to include malicious command injection payloads that get executed with the privileges of the Dokploy service account. This creates a significant escalation path where a low-privilege attacker can potentially gain full control over the host system, execute arbitrary code, and access sensitive data stored on the platform.
The operational impact of this vulnerability is severe as it transforms a legitimate application feature into a vector for remote code execution attacks. Attackers can leverage this weakness to install backdoors, exfiltrate data, or compromise other services running on the same host system. Given that Dokploy is designed as a self-hostable PaaS solution, organizations deploying it may be running in environments where such privilege escalation could lead to complete system compromise. The vulnerability affects all versions prior to 0.29.13, making it a widespread concern for deployments that have not been updated.
Mitigation strategies should focus on implementing proper input validation and sanitization mechanisms within the git cloning functionality. The fix implemented in version 0.29.13 likely involves escaping special characters in user-provided URLs or using parameterized command execution methods that prevent shell interpretation of user input. Organizations should immediately update to version 0.29.13 or later to address this vulnerability, while also implementing additional security measures such as restricting application deployment permissions to trusted users only and monitoring for suspicious deployment activities. This vulnerability aligns with CWE-78 which specifically addresses improper neutralization of special elements used in OS commands, and maps to ATT&CK technique T1059.004 for executing commands through shell injection attacks.
The root cause of this issue demonstrates a fundamental security principle violation where user input is treated as trusted command arguments without proper sanitization. This type of vulnerability commonly occurs in applications that directly concatenate user-controlled data into system commands, highlighting the importance of following secure coding practices and utilizing safe API alternatives that prevent command injection attacks. Organizations should conduct comprehensive security reviews of their deployment automation systems to identify similar patterns that could lead to privilege escalation vulnerabilities.