Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-72738: Dokploy Backup: Authenticated Remote Code Execution via Command Injection
CVE-2026-72738
CVE-2026-72738
Summary
An authenticated user with backup access can execute arbitrary commands on the Dokploy server. This can lead to data loss or system compromise. Update to version 0.29.13 or later to fix this issue.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| dokploy | dokploy | < 0.29.13 |
Original title
Dokploy: Authenticated RCE via Command Injection in backup.listBackupFiles search Parameter
Original description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.listBackupFiles tRPC endpoint in apps/dokploy/server/api/routers/backup.ts passes the search parameter through normalizeS3Path and interpolates it into an rclone lsjson command executed by child_process.exec(), allowing an authenticated user with backup:read permission to execute arbitrary commands on the Dokploy host. This issue is fixed in version 0.29.13.
mitre CVSS3.1
9.9
Vulnerability type
CWE-78
OS Command Injection
- https://github.com/Dokploy/dokploy/security/advisories/GHSA-5vjv-73wr-rf79 x_refsource_CONFIRM
- https://github.com/Dokploy/dokploy/commit/eeb6e7b8ea88e4b4b1fac8460755464100516a... x_refsource_MISC
- https://github.com/Dokploy/dokploy/releases/tag/v0.29.13 x_refsource_MISC
Published: 10 Aug 2026 · Updated: 10 Aug 2026 · First seen: 10 Aug 2026