Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-72875: Dokploy can let attackers run commands on your server

CVE-2026-72875 · published 2 months ago

Summary

Earlier versions of Dokploy let a user with permission to read certain configuration files add extra instructions to a file path. The program then runs that path as part of a system command, allowing the user to execute any command on the server. Upgrade to version 0.29.13 or later and limit the read permission to trusted users only.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
dokploy	dokploy	< 0.29.13

Original advisory text

Dokploy: Remote Code Execution (RCE) via Command Injection in settings.readTraefikFile

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, settings.readTraefikFile in apps/dokploy/server/api/routers/settings.ts passes a path accepted by apiReadTraefikConfig to readConfigInPath in packages/server/src/utils/traefik/application.ts, where configPath is interpolated into execAsyncRemote as cat ${configPath}, allowing a user with traefikFiles.read permission to execute arbitrary commands on a managed server through shell metacharacters. This issue is fixed in version 0.29.13.

References

https://github.com/Dokploy/dokploy/releases/tag/v0.29.13 URL
https://github.com/Dokploy/dokploy/security/advisories/GHSA-j3pv-r5wg-235m Vendor Advisory
https://github.com/Dokploy/dokploy/commit/92310ddb143c8e67ca95eb7db661838a76579f... Patch
https://github.com/Dokploy/dokploy/pull/4873 Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72875... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-72875 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-78OS Command Injection

Timeline

Published10 Aug 2026

Updated31 Oct 2026

First seen10 Aug 2026

Sources

CVE-2026-72875 · NVD

CVE-2026-72875 · MITRE

CVE-2026-72875 · OSV

GHSA-j3pv-r5wg-235m · GHSA

Track software like this

Free during beta