Command Injection Vulnerability in Dokploy PaaS Platform
CVE-2026-72885

NONE

Key Information:

Vendor

Dokploy

Status
Dokploy
Vendor
CVE Published:
10 August 2026

What is CVE-2026-72885?

Dokploy, a self-hostable Platform as a Service (PaaS), was found to have a command injection vulnerability in versions prior to 0.29.13. An improperly handled user input in dockerContextPath allows authenticated application editors to execute arbitrary commands on the host system due to an unquoted cd command. This flaw originates from the getDockerContextPath function, which does not properly sanitize input before it is processed in the Docker execution chain. The issue was resolved in version 0.29.13, emphasizing the importance of input validation and secure command execution practices.

Affected Version(s)

dokploy < 0.29.13

References

https://github.com/Dokploy/dokploy/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/Dokploy/dokploy/pull/4860
x_refsource_MISC
https://github.com/Dokploy/dokploy/commit/cba0b253c7de415...
x_refsource_MISC

CVSS V4

Score:
Severity:
NONE
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.