CVE-2026-72865
CriticalCVSS 9.9Summary
Dokploy before version 0.29.13 in the compose.update operation stores an unvalidated composePath that is interpolated into docker compose -f, docker stack deploy -c, and touch shell commands executed through /bin/sh -c. An authenticated member with compose write and deploy permission can supply a crafted composePath, trigger compose.deploy or startCompose, and execute arbitrary operating-system commands in the Docker-privileged Dokploy host context.
Risk Assessment
An attacker can execute arbitrary commands on the host with Docker privileges, potentially leading to full system and data compromise.
Recommendation
Update Dokploy to version 0.29.13 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the compose.update operation stores an unvalidated composePath that packages/server/src/utils/builders/compose.ts and packages/server/src/services/compose.ts interpolate into docker compose -f, docker stack deploy -c, and touch shell commands executed through /bin/sh -c. An authenticated member with compose write and deploy permission can supply a crafted composePath, trigger compose.deploy or startCompose, and execute arbitrary operating-system commands in the Docker-privileged Dokploy host context. This issue is fixed in version 0.29.13.