Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-72740: Dokploy allows malicious code execution during deployment
CVE-2026-72740 · published 24 days ago
Summary
Dokploy users with deployment permission and SSH keys can execute arbitrary commands on the Dokploy server, potentially leading to unauthorized access or data loss. To fix this, update to Dokploy version 0.29.13 or later. This vulnerability has been addressed by the Dokploy developers.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| dokploy | dokploy | < 0.29.13 |
Original advisory text
Dokploy: OS Command Injection via SSH-form `customGitUrl` domain in `ssh-keyscan`
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, packages/server/src/utils/providers/git.ts parses the user-controlled customGitUrl with sanitizeRepoPathSSH and interpolates its domain into the ssh-keyscan command from addHostToKnownHostsCommand without shell quoting, allowing an authenticated member with service deployment permission and an attached SSH key to execute arbitrary commands on the Dokploy host during deployment. This issue is fixed in version 0.29.13.
Severity
9.9
Critical
CVSS 3.1: 9.9 (NVD)
Exploitation
EPSS <1%
Type
CWE-78OS Command Injection
Timeline
Published10 Aug 2026
Updated3 Sep 2026
First seen10 Aug 2026
Monitor software like this
Free during beta