CVE-2026-72877 in Dokploy
Summary
by MITRE • 08/10/2026
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the dockerImage field is interpolated without quoting into shell commands in buildRemoteDocker() in packages/server/src/utils/providers/docker.ts and is validated only as an optional string. An authenticated user with application create or update permission can use shell command substitution in dockerImage to execute arbitrary commands on the local build host or a remote SSH build target, exposing host secrets and other projects. This issue is fixed in version 0.29.13.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability exists within Dokploy's remote Docker build functionality where the dockerImage field undergoes unsafe shell command interpolation without proper quoting mechanisms. The flaw resides in the buildRemoteDocker() function located in packages/server/src/utils/providers/docker.ts, which processes user-provided docker image names and directly incorporates them into shell commands without adequate sanitization or escaping. The validation logic only treats the dockerImage field as an optional string without implementing proper input validation or sanitization measures that would prevent command injection attacks.
The technical implementation of this vulnerability allows authenticated users with application creation or update permissions to exploit a command injection flaw by embedding shell command substitution syntax within the dockerImage field value. When the system processes these user inputs, it creates shell commands that execute on either the local build host or remote SSH targets depending on the configuration. This unvalidated interpolation enables attackers to inject malicious shell commands that execute with the privileges of the build process, potentially compromising the entire host environment.
The operational impact of this vulnerability is severe as it provides attackers with arbitrary code execution capabilities on the underlying build infrastructure. An attacker could leverage this flaw to access sensitive host secrets stored in environment variables, extract confidential project data, or even escalate privileges to compromise other applications running on the same host. The vulnerability affects both local and remote SSH-based build environments, amplifying the attack surface significantly. Additionally, since the vulnerability requires only application create or update permissions, it can be exploited by users with relatively low-privilege access levels within the system.
This issue directly maps to CWE-78 Shell Injection (CWE-78) and aligns with several ATT&CK techniques including T1059 Command and Scripting Interpreter and T1566 Phishing. The vulnerability represents a classic command injection flaw that occurs when user-controllable data is incorporated into shell commands without proper sanitization. The remediation in version 0.29.13 likely involves implementing proper input validation, escaping, or using safer execution methods such as direct API calls instead of shell command construction. Organizations should ensure all user inputs are properly sanitized and validated before being used in any shell contexts, implementing principle of least privilege for build processes, and regularly updating their software to protect against known vulnerabilities.