CVE-2026-72740
CriticalCVSS 9.9Summary
Dokploy before version 0.29.13 contains a command injection vulnerability in addHostToKnownHostsCommand, where the domain from user-controlled customGitUrl is interpolated into the ssh-keyscan command without proper quoting. An authenticated user with service deployment permission and an attached SSH key can execute arbitrary commands on the Dokploy host during deployment.
Risk Assessment
An attacker can take over the Dokploy host, leading to full compromise of the platform and data.
Recommendation
Upgrade Dokploy to version 0.29.13 or later, which includes the fix.
Original NVD description (English source)
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, packages/server/src/utils/providers/git.ts parses the user-controlled customGitUrl with sanitizeRepoPathSSH and interpolates its domain into the ssh-keyscan command from addHostToKnownHostsCommand without shell quoting, allowing an authenticated member with service deployment permission and an attached SSH key to execute arbitrary commands on the Dokploy host during deployment. This issue is fixed in version 0.29.13.