CVE-2026-72878

CRITICAL 9.6

Dokploy: OS Command Injection in backup/restore pipeline via unescaped user-controlled shell arguments

CVSS Score

9.6

EPSS Score

0.0%

EPSS Percentile

0th

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy's backup and restore pipeline constructs shell commands by directly interpolating user-controlled database fields into bash -c "..." and sh -c "..." strings, then executes them via child_process.exec(). An authenticated admin/owner can inject arbitrary OS commands that execute on the host machine running Dokploy (not just inside a container). This vulnerability is fixed in 0.29.13.

CWE	CWE-78
Vendor	dokploy
Product	dokploy
Published	Aug 10, 2026

Stay Ahead of the Next One

Get instant alerts for dokploy dokploy

Be the first to know when new critical vulnerabilities affecting dokploy dokploy are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

Dokploy / dokploy

< 0.29.13

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Dokploy/dokploy/security/advisories/GHSA-p2c7-8j28-c7gq github.com: https://github.com/Dokploy/dokploy/pull/4873 github.com: https://github.com/Dokploy/dokploy/commit/d02f34f9d48b363b9bf15a948e263ff4ebfcceda github.com: https://github.com/Dokploy/dokploy/releases/tag/v0.29.13