Shell Injection Vulnerability in Dokploy Platform as a Service
CVE-2026-72733
9.9CRITICAL
What is CVE-2026-72733?
Dokploy, a self-hostable Platform as a Service (PaaS), had a security flaw in its backup restoration functionality prior to version 0.29.13. The vulnerability arises from the improper handling of user-controlled inputs in the backup restore process, specifically within the backup.restoreBackupWithLogs tRPC subscription. By leveraging the databaseName and backupFile fields, an authenticated user with backup-restore permissions could execute arbitrary OS commands on the Dokploy host. This could occur even in scenarios where no valid database or backup file exists, posing a significant security risk to the platform's integrity. The issue has been patched in version 0.29.13.
Affected Version(s)
dokploy < 0.29.13