CVE-2026-72882 in Dokploy
Summary
by MITRE • 08/10/2026
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, an authenticated user who can create or update file mounts for a service can inject shell metacharacters into filePath, causing Dokploy to execute attacker-controlled commands on the configured remote managed server over SSH. In the default deployment model, this yields direct remote host RCE from the web interface.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability exists within Dokploy version 0.28.8 and earlier, representing a critical remote code execution flaw that stems from inadequate input validation in the file mount configuration functionality. The issue arises when authenticated users with permissions to create or update file mounts for services can inject shell metacharacters into the filePath parameter, which then gets processed by Dokploy and executed on the remote managed server through SSH connections. This represents a severe authorization bypass vulnerability where legitimate administrative actions become vectors for malicious command injection.
The technical flaw manifests as a command injection vulnerability in the file path handling mechanism, specifically within the SSH execution pipeline that processes user-supplied file paths. When attackers manipulate the filePath parameter to include shell metacharacters such as semicolons, ampersands, or backticks, these characters are interpreted by the underlying shell during command execution, allowing arbitrary commands to be executed on the target server. This vulnerability maps directly to CWE-78, which describes improper neutralization of special elements used in OS commands, and falls under the ATT&CK technique T1059.004 for command and script injection.
The operational impact of this vulnerability is devastating as it provides attackers with direct remote access to the underlying host system from the web interface without requiring additional exploitation steps. In the default deployment model where Dokploy manages remote servers via SSH, authenticated users can escalate their privileges from service configuration rights to full system control. This allows for complete compromise of the managed infrastructure, including data exfiltration, persistence mechanism installation, and further lateral movement within the network.
Mitigation strategies should focus on immediate input sanitization and validation of all user-supplied file paths before processing them through SSH commands. Implementing strict parameter validation that rejects or escapes shell metacharacters in filePath inputs would prevent this vulnerability from being exploited. Additionally, employing principle of least privilege where users only receive necessary permissions for their specific tasks can limit the attack surface. The fix should include proper shell escaping functions and input filtering mechanisms that conform to security standards such as those recommended by OWASP for preventing command injection attacks. Regular security audits and code reviews focusing on input validation in remote execution contexts would help prevent similar vulnerabilities from emerging in future releases.