CVE-2026-72882
CriticalCVSS 9.9Summary
In Dokploy version 0.28.8 and earlier, an authenticated user who can create or update file mounts for a service can inject shell metacharacters into filePath, causing Dokploy to execute attacker-controlled commands on the configured remote managed server over SSH. In the default deployment model, this yields direct remote host RCE from the web interface.
Risk Assessment
An attacker can take control of the remote managed server, potentially leading to data integrity and confidentiality breaches and further attacks.
Recommendation
Update Dokploy to a version later than 0.28.8 where the vulnerability is fixed.
Original NVD description (English source)
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, an authenticated user who can create or update file mounts for a service can inject shell metacharacters into filePath, causing Dokploy to execute attacker-controlled commands on the configured remote managed server over SSH. In the default deployment model, this yields direct remote host RCE from the web interface.