Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-72736: Dokploy: Malicious Code Can Run on Host Server
CVE-2026-72736
CVE-2026-72736
Summary
Dokploy, a self-hosted Platform as a Service, had a security issue where an attacker could potentially run malicious code on the host server. This was fixed in version 0.29.13, so update to the latest version to be safe. If you can't update, consider disabling the vulnerable features to minimize risk.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| dokploy | dokploy | < 0.29.13 |
Original title
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy passes user-controlled values directly into shell commands via unquoted template literal interpolation in th...
Original description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy passes user-controlled values directly into shell commands via unquoted template literal interpolation in the registry credential testing and Docker Swarm cluster management endbpoints. Both endpoints have a safe local code path (using execFileAsync or the Docker API) but a vulnerable remote path (using execAsyncRemote which runs the shell string via SSH). This vulnerability is fixed in 0.29.13.
mitre CVSS3.1
9.9
Vulnerability type
CWE-77
Command Injection
- https://github.com/Dokploy/dokploy/security/advisories/GHSA-4mfc-grxw-6858 x_refsource_CONFIRM
- https://github.com/Dokploy/dokploy/commit/df2779eaeb4a58f0c85d4caa713c776c790fa7... x_refsource_MISC
- https://github.com/Dokploy/dokploy/releases/tag/v0.29.13 x_refsource_MISC
Published: 10 Aug 2026 · Updated: 10 Aug 2026 · First seen: 10 Aug 2026