CVE-2026-72881 in Dokploy
Summary
by MITRE • 08/10/2026
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, database backup and restore command builders in packages/server/src/utils/backups/utils.ts and packages/server/src/utils/restore/utils.ts interpolate database names, usernames, and passwords into nested shell command strings passed to child_process.exec(). An authenticated administrator with permission to create databases and configure backups can use crafted database configuration fields to execute arbitrary commands inside PostgreSQL, MariaDB, MySQL, MongoDB, or LibSQL containers, exposing database data and credentials and potentially enabling escape when a container is overprivileged. This issue is fixed in version 0.29.13.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability exists within Dokploy's database backup and restore functionality where the application fails to properly sanitize user-provided input before incorporating it into shell commands executed via child_process.exec(). The affected code paths are located in packages/server/src/utils/backups/utils.ts and packages/server/src/utils/restore/utils.ts where database configuration parameters including names, usernames, and passwords are directly interpolated into command strings without appropriate escaping or validation. This represents a classic command injection flaw that allows authenticated attackers to execute arbitrary system commands within the context of database containers.
The security implications are severe as an authenticated administrator with sufficient privileges can manipulate database configuration fields to inject malicious payloads into the shell execution environment. When these commands are processed through child_process.exec(), the injected code executes with the privileges of the container process, potentially allowing full compromise of the database instance. The vulnerability affects multiple database systems including PostgreSQL, MariaDB, MySQL, MongoDB, and LibSQL, indicating a widespread impact across different database technologies within the platform. This type of injection vulnerability is categorized under CWE-78 as "Improper Neutralization of Special Elements used in an OS Command" and aligns with ATT&CK technique T1059.004 for command and scripting interpreter.
The operational impact extends beyond simple data exfiltration as successful exploitation could enable privilege escalation when containers operate with elevated permissions. Attackers could potentially escape container boundaries to access host resources or other containerized services, particularly if the database containers are overprivileged. The vulnerability requires authentication but not elevated privileges beyond normal administrative access, making it accessible to users who have already established a foothold within the system. This represents a significant risk for organizations relying on Dokploy's self-hosted PaaS platform where database security is paramount. The fix implemented in version 0.29.13 addresses this by properly sanitizing and escaping all user input before shell command construction, preventing the injection of malicious payloads through database configuration parameters.
Organizations using affected versions should immediately upgrade to 0.29.13 or later while implementing additional monitoring for suspicious backup and restore operations. Security teams should also review container privilege configurations to minimize potential impact if exploitation occurs, ensuring that database containers operate with least privilege principles. The vulnerability demonstrates the critical importance of input validation and proper command construction in applications handling sensitive database operations, particularly when executing system-level commands based on user-provided data.