Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-72733: Dokploy: Malicious Commands Can Be Executed on Server
CVE-2026-72733
CVE-2026-72733
Summary
Dokploy's database restore feature allows authenticated users with permission to execute arbitrary commands on the server. This could lead to unauthorized access or data loss. Update to version 0.29.13 or later to fix this issue.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| dokploy | dokploy | < 0.29.13 |
Original title
Dokploy: OS Command Injection via `databaseName` / `backupFile` in database restore
Original description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds database restore shell pipelines from the user-controlled databaseName and backupFile fields without safely separating them from shell syntax. packages/server/src/utils/restore/utils.ts interpolates databaseName into database-specific restore commands, while packages/server/src/utils/restore/postgres.ts and the analogous restore modules interpolate backupFile into rclone paths. An authenticated member with backup-restore permission can inject operating-system commands that execute in the Dokploy host context through execAsync or execAsyncRemote, even when no valid database container or backup file exists. This issue is fixed in version 0.29.13.
mitre CVSS3.1
9.9
Vulnerability type
CWE-78
OS Command Injection
- https://github.com/Dokploy/dokploy/security/advisories/GHSA-2xjq-p4xx-5x2p x_refsource_CONFIRM
- https://github.com/Dokploy/dokploy/pull/4862 x_refsource_MISC
- https://github.com/Dokploy/dokploy/commit/8539a5c82f47eb3fd1464b574eb034c6dc2a6b... x_refsource_MISC
- https://github.com/Dokploy/dokploy/commit/ccd2e83c57d99f725220d37e0152270e0827d7... x_refsource_MISC
- https://github.com/Dokploy/dokploy/commit/eeb6e7b8ea88e4b4b1fac8460755464100516a... x_refsource_MISC
- https://github.com/Dokploy/dokploy/releases/tag/v0.29.13 x_refsource_MISC
Published: 10 Aug 2026 · Updated: 10 Aug 2026 · First seen: 10 Aug 2026