CVE-2026-72869
CriticalCVSS 9.9Summary
Dokploy before version 0.29.13 in the backup.restoreBackupWithLogs tRPC subscription passes the databaseName parameter to restore builders, where PostgreSQL, MariaDB, MySQL, and MongoDB commands embed the value in nested shell text executed by Node.js exec. An authenticated user with backup:restore permission can supply a crafted databaseName that the host /bin/sh expands before docker exec, resulting in arbitrary commands running in the Docker-privileged host context.
Risk Assessment
An attacker can execute arbitrary commands on the host with Docker privileges, potentially leading to full system and data compromise.
Recommendation
Update Dokploy to version 0.29.13 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription passes the databaseName parameter to restore builders in packages/server/src/utils/restore/utils.ts, where PostgreSQL, MariaDB, MySQL, and MongoDB commands embed the value in nested shell text executed by Node.js exec. An authenticated user with backup:restore permission can supply a crafted databaseName that the host /bin/sh expands before docker exec, resulting in arbitrary commands running in the Docker-privileged host context. This issue is fixed in version 0.29.13.