Insecure Direct Object Reference in Dokploy PaaS

CVE-2026-72867

What is CVE-2026-72867?

Dokploy, a self-hostable Platform as a Service (PaaS), is affected by a vulnerability that stems from an incomplete fix related to input validation in its version management. Specifically, in versions 0.29.3 to 0.29.12, the application fails to properly validate branch fields during requests to compose.update. This oversight permits low-privileged authenticated users to utilize the compose.deploy functionality, which inadvertently allows the execution of potentially harmful shell commands through unchecked Git-based operations. The vulnerability was addressed in version 0.29.13, emphasizing the need for diligent updates and security practices.

References