CVE-2026-72738
CriticalCVSS 9.9Summary
Dokploy before version 0.29.13 contains a command injection vulnerability in the backup.listBackupFiles endpoint, where the search parameter is interpolated into the rclone lsjson command without proper sanitization. An authenticated user with backup:read permission can execute arbitrary commands on the Dokploy host.
Risk Assessment
An attacker can execute arbitrary commands on the Dokploy host, potentially leading to system compromise and data confidentiality breach.
Recommendation
Upgrade Dokploy to version 0.29.13 or later, which includes the fix.
Original NVD description (English source)
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.listBackupFiles tRPC endpoint in apps/dokploy/server/api/routers/backup.ts passes the search parameter through normalizeS3Path and interpolates it into an rclone lsjson command executed by child_process.exec(), allowing an authenticated user with backup:read permission to execute arbitrary commands on the Dokploy host. This issue is fixed in version 0.29.13.