CVE-2026-72874
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Dokploy prior to 0.29.13 contains a command injection vulnerability in cloneGitRepository. An authenticated user with application access can execute arbitrary OS commands on the Dokploy host by setting a malicious custom Git URL and triggering deployment.
Risk Assessment
An authenticated attacker can gain full control of the Dokploy host, potentially leading to data theft or further attacks.
Recommendation
Update Dokploy to version 0.29.13 or later, which includes the fix.
Original NVD description (English source)
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, cloneGitRepository in packages/server/src/utils/providers/git.ts interpolates customGitUrl and customGitBranch into a git clone command passed to execAsync or execAsyncRemote, allowing an authenticated user with application access to execute arbitrary operating system commands on the Dokploy host by setting a malicious custom Git URL and triggering deployment. This issue is fixed in version 0.29.13.