Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

Dokploy allows logged‑in users to run commands on server

CVE-2026-72882 · published 2 months ago
Summary

If a user with an account can add or change file mounts, they can include special characters in the file path that cause Dokploy to run their own commands on the remote server through SSH. This can give an attacker the ability to take control of the host that runs Dokploy. Upgrade to a version newer than 0.28.8 and limit mount‑editing permissions to trusted administrators.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
dokploy dokploy <= 0.28.8
Original advisory text
Dokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed servers
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, an authenticated user who can create or update file mounts for a service can inject shell metacharacters into filePath, causing Dokploy to execute attacker-controlled commands on the configured remote managed server over SSH. In the default deployment model, this yields direct remote host RCE from the web interface.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.9 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published10 Aug 2026
Updated4 Nov 2026
First seen10 Aug 2026
Sources
CVE-2026-72882 · NVD
CVE-2026-72882 · MITRE
CVE-2026-72882 · OSV
GHSA-qcf5-jjjp-7794 · GHSA
Track software like this
Free during beta