Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.6
CVE-2026-72878: Dokploy: Malicious Commands Can Execute on Host Machine
CVE-2026-72878
CVE-2026-72878
Summary
Dokploy's backup and restore feature allows an attacker with admin access to inject malicious commands that can execute on the host machine, potentially leading to unauthorized access or data destruction. To protect your Dokploy instance, update to version 0.29.13 or later. If you cannot update immediately, consider restricting access to the backup and restore feature or disabling it temporarily.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| dokploy | dokploy | < 0.29.13 |
Original title
Dokploy: OS Command Injection in backup/restore pipeline via unescaped user-controlled shell arguments
Original description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy's backup and restore pipeline constructs shell commands by directly interpolating user-controlled database fields into bash -c "..." and sh -c "..." strings, then executes them via child_process.exec(). An authenticated admin/owner can inject arbitrary OS commands that execute on the host machine running Dokploy (not just inside a container). This vulnerability is fixed in 0.29.13.
nvd CVSS3.1
9.6
Vulnerability type
CWE-78
OS Command Injection
Published: 10 Aug 2026 · Updated: 10 Aug 2026 · First seen: 10 Aug 2026