Command Injection Vulnerability in Dokploy PaaS Deployment Functions
CVE-2026-72862

9.9CRITICAL

Key Information:

Vendor

Dokploy

Status
Dokploy
Vendor
CVE Published:
10 August 2026

What is CVE-2026-72862?

Dokploy, a self-hostable Platform as a Service (PaaS), contains a command injection vulnerability stemming from the improper handling of user-controlled dockerImage input in its database service deployment functions across mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts files. This flaw allows malicious users to execute arbitrary commands on the remote server by injecting crafted dockerImage strings. The vulnerability has been addressed in version 0.29.13, and users are strongly encouraged to upgrade to mitigate potential exploitation risks.

Affected Version(s)

dokploy < 0.29.13

References

https://github.com/Dokploy/dokploy/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/Dokploy/dokploy/commit/b24202e69b244f0...
x_refsource_MISC
https://github.com/Dokploy/dokploy/releases/tag/v0.29.13
x_refsource_MISC

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.