CVE-2026-72867
CriticalCVSS 9.9Summary
Dokploy from version 0.29.3 until 0.29.13 has an incomplete fix for CVE-2026-45628, leaving branch fields in packages/server/src/db/schema/compose.ts without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch, branch, gitlabBranch, bitbucketBranch, or giteaBranch. A low-privileged authenticated user can trigger compose.deploy, which passes the stored branch to shell-based Git clone commands, resulting in arbitrary host command execution.
Risk Assessment
An attacker can execute arbitrary commands on the host, potentially leading to full system and data compromise.
Recommendation
Update Dokploy to version 0.29.13 or later, which includes a complete fix for this vulnerability.
Original NVD description (English source)
Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch, branch, gitlabBranch, bitbucketBranch, or giteaBranch. A low-privileged authenticated user can trigger compose.deploy, which passes the stored branch to shell-based Git clone commands in packages/server/src/utils/providers/git.ts, github.ts, gitlab.ts, bitbucket.ts, and gitea.ts, resulting in arbitrary host command execution. This issue is fixed in version 0.29.13.