CVE-2026-72884 in Dokploy
Summary
by MITRE • 08/10/2026
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, sanitizeCommand in packages/server/src/utils/builders/compose.ts only trims whitespace and strips surrounding quotes from compose.command before exportEnvCommand and docker command interpolation, allowing an authenticated user who can update a Compose service to inject shell metacharacters and execute arbitrary commands on the Dokploy host. This issue is fixed in version 0.29.13.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability identified in Dokploy affects versions prior to 02913 and stems from inadequate input sanitization within the compose command processing functionality. The sanitizeCommand function located in packages/server/src/utils/builders/compose.ts demonstrates a critical flaw in its security implementation by only performing basic whitespace trimming and quote stripping operations. This superficial sanitization approach fails to address the fundamental security concern of shell injection attacks that could be exploited by authenticated users with sufficient privileges to modify compose service configurations. The vulnerability specifically impacts the exportEnvCommand and docker command interpolation processes where unfiltered command inputs are directly utilized without proper validation or escaping mechanisms.
The technical implementation flaw resides in the inadequate handling of user-supplied command strings within the compose service management system. When an authenticated user updates a Compose service definition, the sanitizeCommand function processes the compose.command value by merely removing leading and trailing whitespace characters and stripping surrounding quotes from the input. However, this minimal sanitization does not account for shell metacharacters such as semicolons, ampersands, pipes, backticks, or other special characters that could be leveraged to execute arbitrary commands on the host system. The function's limited scope of operation creates a direct pathway for command injection attacks where malicious payloads can bypass basic filtering and directly influence the shell execution environment.
The operational impact of this vulnerability extends beyond simple privilege escalation as it enables authenticated attackers to execute arbitrary code with the privileges of the Dokploy service account running on the host system. This represents a severe security compromise that could allow attackers to access sensitive data, modify configurations, install malware, or even escalate their privileges further within the compromised environment. The vulnerability affects any user who possesses the ability to update Compose services, which in many deployment scenarios might include developers or administrators with standard access rights to application configurations. The implications are particularly concerning for self-hosted environments where the host system may contain sensitive infrastructure components or where the Dokploy service operates with elevated privileges.
The security implications align with common weaknesses identified in the CWE database, specifically relating to improper input validation and command injection vulnerabilities. This flaw demonstrates a failure to implement proper input sanitization techniques that would prevent shell metacharacter interpretation during command execution. The vulnerability also maps to ATT&CK tactics related to privilege escalation and execution through compromised service accounts, as attackers could leverage this weakness to gain unauthorized access to system resources. Organizations using Dokploy versions prior to 02913 should immediately implement mitigations such as restricting user permissions for compose service modifications, implementing additional input validation layers, and monitoring for suspicious command executions within their deployment environments.
The fix implemented in version 02913 addresses this vulnerability by enhancing the sanitizeCommand function to properly validate and escape shell metacharacters rather than simply trimming whitespace and stripping quotes. This improved sanitization approach ensures that user-supplied command inputs are thoroughly processed before being used in docker command interpolation, preventing malicious payloads from being executed as part of the service deployment process. The updated implementation likely incorporates more robust input validation techniques that comply with security best practices for shell command execution and prevent the exploitation of similar injection vulnerabilities in related components. Organizations should verify their deployments are updated to version 02913 or later to ensure protection against this specific command injection threat vector.