CVE-2026-72879 in Dokploy
Summary
by MITRE • 08/10/2026
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.8, the getRegistryCommands() function in packages/server/src/utils/cluster/upload.ts interpolates registry.password and registry.registryUrl directly into a shell command without escaping. An authenticated user with project access can configure malicious registry credentials and trigger a swarm deployment to execute arbitrary OS commands on the Dokploy server, read or modify host files, and access other containers through Docker. This issue is fixed in version 0.29.8.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability in Dokploy affects versions prior to 0298 where the getRegistryCommands function in packages/server/src/utils/cluster/upload.ts contains a critical command injection flaw. This function directly interpolates registry.password and registry.registryUrl values into shell commands without proper escaping or sanitization mechanisms. The flaw exists within the container deployment pipeline where Docker registry credentials are processed during swarm deployments, creating an environment where authenticated users can manipulate the deployment flow through maliciously configured registry parameters.
This security weakness represents a classic command injection vulnerability that maps to CWE-78 in the Common Weakness Enumeration catalog, specifically involving the improper neutralization of special elements used in shell commands. The issue manifests when an authenticated user with project access modifies registry credentials to include malicious payloads that get executed within the context of the Dokploy server's shell environment. The vulnerability extends beyond simple command execution to provide attackers with comprehensive access to underlying host resources and container orchestration capabilities.
The operational impact of this vulnerability is severe as it allows authenticated attackers to execute arbitrary operating system commands on the Dokploy server with the privileges of the running service. Attackers can read or modify host files, access other containers through Docker runtime interfaces, and potentially escalate their privileges within the deployment environment. This creates a significant attack surface where compromised projects can lead to complete server compromise and lateral movement throughout containerized deployments.
Mitigation strategies should focus on implementing proper input sanitization and escaping mechanisms for all shell command interpolations. The fix implemented in version 0298 addresses this by ensuring that registry credentials are properly escaped before being incorporated into shell commands. Organizations should also implement principle of least privilege access controls, restrict project-level registry configuration capabilities, and consider using more secure deployment methods that avoid direct shell command execution for credential handling. Additionally, regular security audits of code paths involving shell command construction should be conducted to prevent similar vulnerabilities from emerging in other parts of the application.