CVE-2026-72733 Dokploy CVE debrief

Who should care

Dokploy administrators and security teams should assess exposure and apply the fix. Users with backup-restore permissions should be monitored for suspicious activity. Operators of Dokploy platforms, vulnerability management teams, and security teams should review the vulnerability and apply necessary mitigations. Security teams should also monitor for potential exploitation attempts and verify the fix has been applied.

Why it matters

CVE-2026-72733 is a critical command injection vulnerability in Dokploy that allows an authenticated member with backup-restore permission to execute operating system commands in the Dokploy host context. The vulnerability is fixed in version 0.29.13, and administrators should assess exposure and apply the fix.

• Command injection can lead to unauthorized operating system commands execution in the Dokploy host context.
• An authenticated member with backup-restore permission can exploit this vulnerability.
• The vulnerability can be used to execute commands even when no valid database container or backup file exists.
• Verification of the fix and monitoring for suspicious activity are necessary.

Technical summary

The backup.restoreBackupWithLogs tRPC subscription in Dokploy builds database restore shell pipelines from user-controlled databaseName and backupFile fields without safely separating them from shell syntax. This allows an authenticated member with backup-restore permission to inject operating-system commands. The vulnerability can be used to execute commands even when no valid database container or backup file exists. The fix is available in version 0.29.13, which safely separates user input from shell syntax to prevent command injection.

Defensive priority

High priority for Dokploy administrators and security teams to assess exposure and apply the fix.

Recommended defensive actions

• Assess exposure by checking if Dokploy is deployed and if the backup-restore permission is assigned to any users.
• Verify if the fix has been applied by updating to version 0.29.13.
• Monitor for suspicious activity related to the backup-restore functionality.
• Restrict backup-restore permissions to only necessary users.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source references indicate that Dokploy versions prior to 0.29.13 are vulnerable to command injection. The fix is available in version 0.29.13. Evidence limits suggest that affected deployments should be verified for exposure and updated or mitigated accordingly. Defenders should verify the fix has been applied and monitor for suspicious activity related to backup-restore functionality.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.