CVE-2026-72870

UNKNOWN 0.0

Dokploy: Command Injection via Docker Credentials in buildRemoteDocker

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the buildRemoteDocker() function in packages/server/src/utils/providers/docker.ts interpolates the application-controlled dockerImage value directly into a docker pull shell command. An authenticated user with project access can set a crafted dockerImage through application.update and trigger application.deploy, causing execAsync() to execute arbitrary operating-system commands as the Dokploy server process. This issue is fixed in version 0.29.13.

CWE	CWE-78
Vendor	dokploy
Product	dokploy
Published	Aug 10, 2026

Stay Ahead of the Next One

Get instant alerts for dokploy dokploy

Be the first to know when new unknown vulnerabilities affecting dokploy dokploy are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Dokploy / dokploy

< 0.29.13

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Dokploy/dokploy/security/advisories/GHSA-g9cg-4mmj-mh7p github.com: https://github.com/Dokploy/dokploy/pull/4860 github.com: https://github.com/Dokploy/dokploy/commit/cba0b253c7de4157dd932de7f16a2ad247c7cee9 github.com: https://github.com/Dokploy/dokploy/releases/tag/v0.29.13