Dokploy up to 0.29.12 Git Provider Branch compose.ts input validation

Summaryinfo

A vulnerability was found in Dokploy up to 0.29.12 and classified as critical. Affected by this vulnerability is an unknown functionality of the file packages/server/src/db/schema/compose.ts of the component Git Provider Branch Handler. Such manipulation of the argument customGitBranch/branch/gitlabBranch/bitbucketBranch/giteaBranch leads to input validation. This vulnerability is referenced as CVE-2026-72867. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in Dokploy up to 0.29.12 and classified as critical. Affected by this issue is an unknown code of the file packages/server/src/db/schema/compose.ts of the component Git Provider Branch Handler. The manipulation of the argument customGitBranch/branch/gitlabBranch/bitbucketBranch/giteaBranch with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch, branch, gitlabBranch, bitbucketBranch, or giteaBranch. A low-privileged authenticated user can trigger compose.deploy, which passes the stored branch to shell-based Git clone commands in packages/server/src/utils/providers/git.ts, github.ts, gitlab.ts, bitbucket.ts, and gitea.ts, resulting in arbitrary host command execution. This issue is fixed in version 0.29.13.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-72867 since 08/10/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available.

Upgrading to version 0.29.13 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Dokploy

Version

• 0.29.0
• 0.29.1
• 0.29.2
• 0.29.3
• 0.29.4
• 0.29.5
• 0.29.6
• 0.29.7
• 0.29.8
• 0.29.9
• 0.29.10
• 0.29.11
• 0.29.12

Website

• Product: https://github.com/Dokploy/dokploy/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion