Dokploy up to 0.29.12 Docker Build docker-file.ts execAsync dockerContextPath improper synchronization

Summaryinfo

A vulnerability, which was classified as very critical, has been found in Dokploy up to 0.29.12. The affected element is the function execAsync of the file packages/server/src/utils/builders/docker-file.ts of the component Docker Build. The manipulation of the argument dockerContextPath leads to improper synchronization. This vulnerability is traded as CVE-2026-72885. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Dokploy up to 0.29.12. It has been rated as very critical. This issue affects the function execAsync of the file packages/server/src/utils/builders/docker-file.ts of the component Docker Build. The manipulation of the argument dockerContextPath with an unknown input leads to a improper synchronization vulnerability. Using CWE to declare the problem leads to CWE-662. The product utilizes multiple threads or processes to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, dockerContextPath accepted by apps/dokploy/components/dashboard/application/build/show.tsx flows through getDockerContextPath in packages/server/src/utils/filesystem/directory.ts into the unquoted cd command in packages/server/src/utils/builders/docker-file.ts before execution by execAsync, allowing an authenticated application editor to execute arbitrary commands on the Dokploy host. This issue is fixed in version 0.29.13.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-72885 since 08/10/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/10/2026).

Upgrading to version 0.29.13 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Dokploy

Version

• 0.29.0
• 0.29.1
• 0.29.2
• 0.29.3
• 0.29.4
• 0.29.5
• 0.29.6
• 0.29.7
• 0.29.8
• 0.29.9
• 0.29.10
• 0.29.11
• 0.29.12

Website

• Product: https://github.com/Dokploy/dokploy/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion