CVE-2026-72872
CriticalCVSS 9.9Summary
Dokploy before version 0.29.13 does not validate the bitbucketOwner and bitbucketRepository fields when saving a Bitbucket provider, and later interpolates them into git clone commands executed via execAsync or execAsyncRemote. This allows a member with service deployment permission to execute arbitrary operating system commands on the Dokploy host or target server.
Risk Assessment
An attacker can take control of the Dokploy host or target server, leading to full compromise of the infrastructure and data.
Recommendation
Update Dokploy to version 0.29.13 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, application.saveBitbucketProvider stores bitbucketOwner and bitbucketRepository without validation and cloneBitbucketRepository in packages/server/src/utils/providers/bitbucket.ts interpolates those values into git clone commands executed through execAsync or execAsyncRemote, allowing a member with service deployment permission to execute arbitrary operating system commands on the Dokploy host or target server. This issue is fixed in version 0.29.13.