CVE-2026-72869 Dokploy CVE debrief

Who should care

Administrators and users of Dokploy instances should assess their exposure and take action to mitigate the vulnerability. This includes updating to version 0.29.13 or later and restricting backup:restore permissions to trusted users.

Why it matters

CVE-2026-72869 is a critical command injection vulnerability in Dokploy's backup.restoreBackupWithLogs tRPC subscription. An authenticated user with backup:restore permission can inject arbitrary commands, which are executed in the Docker-privileged host context. This vulnerability requires immediate attention from Dokploy administrators and users to prevent potential exploitation.

• Authenticated users with backup:restore permission can inject arbitrary commands
• Commands are executed in the Docker-privileged host context
• Vulnerability allows for potential lateral movement within the host
• Remediation requires updating to Dokploy version 0.29.13 or later

Technical summary

The Dokploy backup.restoreBackupWithLogs tRPC subscription is vulnerable to command injection due to improper handling of the databaseName parameter. An authenticated user with backup:restore permission can supply a crafted databaseName parameter, which is executed in a nested shell context by Node.js exec. This allows arbitrary commands to run in the Docker-privileged host context. The issue is fixed in Dokploy version 0.29.13. The vulnerability requires immediate attention from Dokploy administrators and users to prevent potential exploitation.

Defensive priority

High

Recommended defensive actions

• Review and update Dokploy to version 0.29.13 or later
• Restrict backup:restore permissions to trusted users
• Monitor Dokploy instances for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Dokploy's backup.restoreBackupWithLogs tRPC subscription. The issue allows an authenticated user with backup:restore permission to inject arbitrary commands in the Docker-privileged host context. The vulnerability is fixed in version 0.29.13.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.