CVE-2026-72739
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Dokploy prior to 0.29.13 contains a vulnerability in the createCommand() function that constructs shell commands by interpolating compose service names and configuration into bash command strings. When a compose with a maliciously crafted name or service definition is deployed, shell metacharacters are interpreted as command separators, allowing arbitrary command execution on the Docker host.
Risk Assessment
An attacker can execute arbitrary commands on the Docker host, potentially leading to full platform compromise and data breach.
Recommendation
Upgrade Dokploy to version 0.29.13 or later, which includes the fix. Additionally, validate compose service names and definitions before deployment.
Original NVD description (English source)
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the createCommand() function constructs shell commands by interpolating compose service names and configuration into bash command strings. When a compose with a maliciously crafted name or service definition is deployed, the shell metacharacters are interpreted as command separators, allowing arbitrary command execution on the Docker host. This vulnerability is fixed in 0.29.13.