CVE-2026-72875
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
Dokploy prior to 0.29.13 contains a command injection vulnerability in settings.readTraefikFile. A user with traefikFiles.read permission can execute arbitrary commands on a managed server via shell metacharacters in the configPath.
Risk Assessment
An attacker with limited privileges can take over the managed server, leading to full infrastructure compromise.
Recommendation
Update Dokploy to version 0.29.13 or later, which includes the fix.
Original NVD description (English source)
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, settings.readTraefikFile in apps/dokploy/server/api/routers/settings.ts passes a path accepted by apiReadTraefikConfig to readConfigInPath in packages/server/src/utils/traefik/application.ts, where configPath is interpolated into execAsyncRemote as cat ${configPath}, allowing a user with traefikFiles.read permission to execute arbitrary commands on a managed server through shell metacharacters. This issue is fixed in version 0.29.13.