Arbitrary Command Execution in Dokploy Platform as a Service by Vulnerability in Bitbucket Repository Handling
CVE-2026-72872

9.9CRITICAL

Key Information:

Vendor

Dokploy

Status
Dokploy
Vendor
CVE Published:
10 August 2026

What is CVE-2026-72872?

Dokploy, a self-hostable Platform as a Service, has a vulnerability that allows a member with deployment permissions to execute arbitrary operating system commands. This occurs due to inadequate validation of Bitbucket repository details stored during deployment. Specifically, the values for bitbucketOwner and bitbucketRepository are directly included in git clone commands without proper sanitization. As a result, attackers can exploit this flaw to run malicious commands on the Dokploy host or the target server. The issue has been resolved in version 0.29.13.

Affected Version(s)

dokploy < 0.29.13

References

https://github.com/Dokploy/dokploy/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/Dokploy/dokploy/pull/4855
x_refsource_MISC
https://github.com/Dokploy/dokploy/commit/47347ab885b0ad1...
x_refsource_MISC

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.