CVE-2026-72862
CriticalCVSS 9.9Summary
Dokploy before version 0.29.13 in the mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts database service deployment functions pass user-controlled dockerImage fields unquoted into docker pull ${dockerImage} shell commands on the remote-server code path.
Risk Assessment
An attacker can execute arbitrary commands on the remote server, potentially leading to server takeover and data compromise.
Recommendation
Update Dokploy to version 0.29.13 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts Dokploy database service deployment functions pass user-controlled dockerImage fields unquoted into docker pull ${dockerImage} shell commands on the remote-server code path. This vulnerability is fixed in 0.29.13.