CVE-2026-72885 in Dokploy
Summary
by MITRE • 08/10/2026
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, dockerContextPath accepted by apps/dokploy/components/dashboard/application/build/show.tsx flows through getDockerContextPath in packages/server/src/utils/filesystem/directory.ts into the unquoted cd command in packages/server/src/utils/builders/docker-file.ts before execution by execAsync, allowing an authenticated application editor to execute arbitrary commands on the Dokploy host. This issue is fixed in version 0.29.13.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability exists within Dokploy's application build processing system where untrusted input flows through multiple layers of the codebase without proper sanitization. The flaw originates in the dockerContextPath parameter which is accepted by the dashboard application build component and subsequently processed through a chain of functions that ultimately leads to command execution. The specific technical issue occurs when the getDockerContextPath utility function in packages/server/src/utils/filesystem/directory.ts passes user-controlled data directly into a cd command without proper quoting or validation.
The vulnerability represents a classic command injection flaw that operates at the system level through the execAsync execution mechanism. When an authenticated application editor provides malicious input through the dockerContextPath parameter, this input gets incorporated into a shell command without appropriate escaping or sanitization. The unquoted cd command in packages/server/src/utils/builders/docker-file.ts creates an environment where arbitrary commands can be executed with the privileges of the Dokploy service account. This type of vulnerability falls under CWE-78 which specifically addresses improper neutralization of special elements used in OS commands.
The operational impact of this vulnerability is significant as it allows authenticated users with application editor permissions to execute arbitrary code on the host system where Dokploy is running. Attackers could potentially escalate their privileges, access sensitive data, or compromise other services running on the same host. The attack surface is limited to authenticated users who have edit permissions for applications within Dokploy, but this still represents a critical privilege escalation vector. This vulnerability aligns with ATT&CK technique T1059.001 which covers command and scripting interpreter usage through shell commands.
Mitigation strategies should focus on input validation and proper sanitization of all user-provided parameters before they reach system-level command execution. The fix implemented in version 0.29.13 likely involves proper quoting or escaping of the dockerContextPath parameter when constructing shell commands, ensuring that special characters are properly handled. Additionally, implementing strict input validation to reject potentially dangerous patterns and employing principle of least privilege for the Dokploy service account would reduce the overall impact. Organizations should also consider implementing network segmentation and monitoring for unusual command execution patterns to detect potential exploitation attempts.