CVE-2026-72736
CriticalCVSS 9.9Summary
Dokploy before version 0.29.13 contains a command injection vulnerability in registry credential testing and Docker Swarm cluster management endpoints, where user-controlled values are interpolated into shell commands without proper quoting. The vulnerable remote path uses execAsyncRemote, allowing arbitrary command execution on remote servers.
Risk Assessment
An attacker can execute arbitrary commands on remote servers managed by Dokploy, potentially leading to full infrastructure compromise.
Recommendation
Upgrade Dokploy to version 0.29.13 or later, which includes the fix.
Original NVD description (English source)
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy passes user-controlled values directly into shell commands via unquoted template literal interpolation in the registry credential testing and Docker Swarm cluster management endbpoints. Both endpoints have a safe local code path (using execFileAsync or the Docker API) but a vulnerable remote path (using execAsyncRemote which runs the shell string via SSH). This vulnerability is fixed in 0.29.13.