Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-72901: Dokploy: Authenticated User Can Run Commands on Server
CVE-2026-72901
CVE-2026-72901
Summary
An authenticated user can run commands on the Dokploy server with root privileges. This is a serious security risk because it allows an attacker to take control of the server. To fix this issue, update to version 0.29.13 or later.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| dokploy | dokploy | < 0.29.13 |
Original title
Dokploy: Remote Code Execution via volume-backup
Original description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated low-privilege member to execute arbitrary commands on the control-plane host because the volumeName field accepted by volumeBackup.create and volumeBackup.runManually is interpolated without quoting in packages/server/src/utils/volume-backups/backup.ts and executed through child_process.exec, with Docker socket access making execution host/root-equivalent. This issue is fixed in version 0.29.13.
nvd CVSS3.1
9.9
Vulnerability type
CWE-78
OS Command Injection
Published: 10 Aug 2026 · Updated: 10 Aug 2026 · First seen: 10 Aug 2026