Remote Command Injection in Dokploy PaaS

CVE-2026-72736

What is CVE-2026-72736?

Dokploy is a self-hostable Platform as a Service (PaaS) that passes user-controlled values directly into shell commands without proper sanitization. This issue arises in the registry credential testing and Docker Swarm cluster management endpoints. While there is a secured local code path available, the vulnerable remote path executes shell commands via SSH, allowing potential attackers to exploit these commands if they manage to send specially crafted inputs. This vulnerability has been addressed in version 0.29.13, emphasizing the importance of keeping PaaS platforms updated.

References