CVE-2026-72884

UNKNOWN 0.0

Dokploy: Command Injection via Compose Custom Command

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, sanitizeCommand in packages/server/src/utils/builders/compose.ts only trims whitespace and strips surrounding quotes from compose.command before exportEnvCommand and docker command interpolation, allowing an authenticated user who can update a Compose service to inject shell metacharacters and execute arbitrary commands on the Dokploy host. This issue is fixed in version 0.29.13.

CWE	CWE-78
Vendor	dokploy
Product	dokploy
Published	Aug 10, 2026

Stay Ahead of the Next One

Get instant alerts for dokploy dokploy

Be the first to know when new unknown vulnerabilities affecting dokploy dokploy are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Dokploy / dokploy

< 0.29.13

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Dokploy/dokploy/security/advisories/GHSA-qh6h-669j-77rw github.com: https://github.com/Dokploy/dokploy/pull/4863 github.com: https://github.com/Dokploy/dokploy/commit/d48037a80203bb0ecaec4f5653aef75fcfdb656d github.com: https://github.com/Dokploy/dokploy/releases/tag/v0.29.13