CVE-2026-72733 Dokploy CVE debrief

Who should care

Administrators and users of Dokploy platform with backup-restore permissions should assess exposure and apply the patch. Dokploy administrators and users with backup-restore permissions should review and apply the patch in version 0.29.13, restrict backup-restore permissions to trusted users, and monitor for suspicious activity on Dokploy hosts.

Why it matters

CVE-2026-72733 is a critical remote command injection vulnerability in the Dokploy platform. An authenticated user with backup-restore permissions can inject operating-system commands, potentially leading to remote code execution, privilege escalation, and lateral movement. Dokploy administrators and users with backup-restore permissions should assess exposure and apply the patch in version 0.29.13.

• Potential remote code execution on Dokploy hosts
• Elevation of privileges for authenticated users with backup-restore permissions
• Possible lateral movement within the host context

Technical summary

The Dokploy platform has a remote command injection vulnerability prior to version 0.29.13. An authenticated member with backup-restore permission can inject operating-system commands that execute in the Dokploy host context through execAsync or execAsyncRemote. This vulnerability can lead to potential remote code execution on Dokploy hosts, elevation of privileges for authenticated users with backup-restore permissions, and possible lateral movement within the host context. The issue is addressed in version 0.29.13.

Defensive priority

High

Recommended defensive actions

• Review and apply the patch in version 0.29.13
• Restrict backup-restore permissions to trusted users
• Monitor for suspicious activity on Dokploy hosts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. The Dokploy platform has a remote command injection vulnerability prior to version 0.29.13. An authenticated member with backup-restore permission can inject operating-system commands that execute in the Dokploy host context through execAsync or execAsyncRemote. The vulnerability allows for potential remote code execution on Dokploy hosts, elevation of privileges for authenticated users with backup-restore permissions, and possible lateral movement within the host.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.