Arbitrary Command Execution in Dokploy PaaS Due to Shell Command Construction Flaw
CVE-2026-72739

6.5MEDIUM

Key Information:

Vendor

Dokploy

Status
Dokploy
Vendor
CVE Published:
10 August 2026

What is CVE-2026-72739?

Dokploy, a self-hostable Platform as a Service (PaaS), contained a vulnerability that allowed arbitrary command execution on the Docker host. This occurred because the createCommand() function improperly interpolated service names and configurations into bash command strings prior to version 0.29.13. When a compose was deployed with maliciously crafted names or service definitions, shell metacharacters were executed as command separators, leading to potential exploitation. Users are urged to upgrade to version 0.29.13 or later to mitigate this issue.

Affected Version(s)

dokploy < 0.29.13

References

https://github.com/Dokploy/dokploy/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/Dokploy/dokploy/commit/d48037a80203bb0...
x_refsource_MISC
https://github.com/Dokploy/dokploy/releases/tag/v0.29.13
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.