CVE-2026-72735
CriticalCVSS 9.9Summary
Dokploy before version 0.29.13 contains a command injection vulnerability in writeTraefikConfigRemote, where user-controlled Traefik configuration is interpolated into an echo command executed via execAsyncRemote. Single quotes in redirect regex, usernames, domains, or middleware configuration can break shell quoting and execute arbitrary commands on remote servers. This is an incomplete fix for CVE-2026-45630.
Risk Assessment
An attacker can execute arbitrary commands on remote servers with the privileges of the configured SSH user, potentially leading to server takeover.
Recommendation
Upgrade Dokploy to version 0.29.13 or later, which includes the complete fix.
Original NVD description (English source)
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed through execAsyncRemote. Single quotes in redirect regex and replacement fields, basic authentication usernames, domain host values, or middleware configuration can terminate the shell quoting and execute arbitrary commands on managed remote servers with the configured SSH user's privileges. This vulnerability is caused by an incomplete fix for CVE-2026-45630. This issue is fixed in version 0.29.13.