Remote Command Execution Vulnerability in Dokploy Platform by Dokploy
CVE-2026-72882

9.9CRITICAL

Key Information:

Vendor

Dokploy

Status
Dokploy
Vendor
CVE Published:
10 August 2026

What is CVE-2026-72882?

Dokploy, a self-hostable Platform as a Service, harbors a vulnerability allowing authenticated users to inject shell metacharacters into the filePath parameter when creating or updating file mounts. This exploitation can lead to unintended executions of commands on the managed server through SSH. In default deployment scenarios, this results in severe risks, enabling attackers to execute arbitrary commands from the web interface, potentially compromising server integrity. Organizations using Dokploy versions 0.28.8 and earlier should take immediate action to secure their installations.

Affected Version(s)

dokploy <= 0.28.8

References

https://github.com/Dokploy/dokploy/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.