Arbitrary Command Execution Vulnerability in Dokploy Platform
CVE-2026-72870

8.7HIGH

Key Information:

Vendor

Dokploy

Status
Dokploy
Vendor
CVE Published:
10 August 2026

What is CVE-2026-72870?

Dokploy, a self-hostable Platform as a Service (PaaS), is susceptible to an arbitrary command execution vulnerability due to the improper handling of user-supplied input. Specifically, in versions prior to 0.29.13, the buildRemoteDocker() function directly interpolates a potentially malicious dockerImage value into a Docker pull command. This allows an authenticated user with project access to exploit the application by submitting a crafted dockerImage via application.update. When triggering application.deploy, this can lead to the execution of arbitrary operating system commands within the context of the Dokploy server process. Users are advised to update to version 0.29.13 or later to resolve this issue.

Affected Version(s)

dokploy < 0.29.13

References

https://github.com/Dokploy/dokploy/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/Dokploy/dokploy/pull/4860
x_refsource_MISC
https://github.com/Dokploy/dokploy/commit/cba0b253c7de415...
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.