CVE-2026-72878 in Dokploy
Summary
by MITRE • 08/10/2026
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy's backup and restore pipeline constructs shell commands by directly interpolating user-controlled database fields into bash -c "..." and sh -c "..." strings, then executes them via child_process.exec(). An authenticated admin/owner can inject arbitrary OS commands that execute on the host machine running Dokploy (not just inside a container). This vulnerability is fixed in 0.29.13.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability exists within Dokploy's backup and restore functionality where the application fails to properly sanitize user-controlled input before incorporating it into shell command execution. The flaw manifests when the system constructs shell commands by directly interpolating database fields containing user-provided data into bash -c "..." and sh -c "..." command strings. This represents a classic command injection vulnerability that operates at the operating system level rather than within containerized environments, making it particularly dangerous as it can execute arbitrary code on the host machine running the Dokploy service.
The technical implementation of this vulnerability involves the use of child_process.exec() function which executes shell commands with elevated privileges, allowing an authenticated attacker with admin or owner permissions to manipulate database fields that are subsequently used in shell command construction. This creates a path for arbitrary command execution where malicious input can bypass normal security boundaries and directly impact the host system's operating environment. The vulnerability is classified as CWE-78 due to improper neutralization of special elements used in OS commands, and aligns with ATT&CK technique T1059.004 for executing commands through shell interactions.
The operational impact of this vulnerability is severe as it allows authenticated attackers to gain complete control over the host machine running Dokploy, potentially leading to data compromise, system takeover, or lateral movement within the infrastructure. An attacker could leverage this to execute malicious code, exfiltrate sensitive information, install backdoors, or disrupt services. The fact that this occurs outside of container boundaries makes it particularly concerning for self-hosted deployments where administrative access typically implies trust but not immunity from such attacks. The vulnerability affects all versions prior to 0.29.13 and represents a critical security gap in the application's input validation and command execution handling mechanisms.
The recommended mitigation involves implementing proper input sanitization and validation of all user-controlled data before incorporating it into shell commands. This includes using parameterized approaches instead of string concatenation for shell command construction, employing whitelisting mechanisms for allowed characters and values, and ensuring that all database fields used in command generation undergo rigorous validation. Additionally, the application should implement proper privilege separation, running backup operations with minimal required permissions rather than administrative privileges. The fix implemented in version 0.29.13 likely includes comprehensive input sanitization and command construction improvements that address the root cause of the vulnerability, aligning with security best practices outlined in OWASP Top Ten and NIST cybersecurity guidelines for preventing command injection attacks.