CVE-2026-72870
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Dokploy before version 0.29.13 contains a command injection vulnerability in the buildRemoteDocker() function, where the dockerImage value is directly interpolated into a docker pull shell command. An authenticated user with project access can execute arbitrary OS commands on the Dokploy server.
Risk Assessment
An attacker can take control of the Dokploy server process, potentially leading to full platform compromise and data breach.
Recommendation
Update Dokploy to version 0.29.13 or later, which includes the fix.
Original NVD description (English source)
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the buildRemoteDocker() function in packages/server/src/utils/providers/docker.ts interpolates the application-controlled dockerImage value directly into a docker pull shell command. An authenticated user with project access can set a crafted dockerImage through application.update and trigger application.deploy, causing execAsync() to execute arbitrary operating-system commands as the Dokploy server process. This issue is fixed in version 0.29.13.