Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-72882: Dokploy: Attacker Can Run Commands on Managed Servers
CVE-2026-72882
CVE-2026-72882
Summary
Dokploy's web interface allows attackers to run commands on remote servers if they have the ability to create or update file mounts. This can happen if an attacker has an account on the Dokploy server and can create or update file mounts for a service. To protect your servers, update Dokploy to the latest version.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| dokploy | dokploy | <= 0.28.8 |
Original title
Dokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed servers
Original description
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, an authenticated user who can create or update file mounts for a service can inject shell metacharacters into filePath, causing Dokploy to execute attacker-controlled commands on the configured remote managed server over SSH. In the default deployment model, this yields direct remote host RCE from the web interface.
nvd CVSS3.1
9.9
Vulnerability type
CWE-78
OS Command Injection
Published: 10 Aug 2026 · Updated: 10 Aug 2026 · First seen: 10 Aug 2026