CVE-2026-72879
CriticalCVSS 9.4Summary
In Dokploy prior to 0.29.8, the getRegistryCommands() function in upload.ts interpolates registry.password and registry.registryUrl directly into a shell command without escaping. An authenticated user with project access can configure malicious registry credentials and trigger a swarm deployment to execute arbitrary OS commands on the Dokploy server, read or modify host files, and access other containers through Docker. This issue is fixed in version 0.29.8.
Risk Assessment
An attacker can execute arbitrary commands on the Dokploy server, leading to full host compromise and potentially other containers.
Recommendation
Update Dokploy to version 0.29.8 or later to remediate the vulnerability.
Original NVD description (English source)
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.8, the getRegistryCommands() function in packages/server/src/utils/cluster/upload.ts interpolates registry.password and registry.registryUrl directly into a shell command without escaping. An authenticated user with project access can configure malicious registry credentials and trigger a swarm deployment to execute arbitrary OS commands on the Dokploy server, read or modify host files, and access other containers through Docker. This issue is fixed in version 0.29.8.