CVE-2026-72874 Dokploy CVE debrief

Who should care

Administrators and users of Dokploy installations, especially those with authenticated access to application features, should assess exposure and prioritize updating to version 0.29.13 or later.

Why it matters

CVE-2026-72874 is a high-severity vulnerability in Dokploy that allows authenticated users to execute arbitrary operating system commands. It is fixed in Dokploy version 0.29.13. Dokploy administrators and users with application access should verify their exposure and update or apply mitigations as necessary.

• Authenticated users can execute arbitrary operating system commands
• Potential for lateral movement and exploitation of other systems
• Need for urgent patching or mitigation to prevent exploitation
• Verification of Dokploy version and exposure required

Technical summary

The cloneGitRepository function in packages/server/src/utils/providers/git.ts interpolates customGitUrl and customGitBranch into a git clone command passed to execAsync or execAsyncRemote. This allows an authenticated user with application access to execute arbitrary operating system commands on the Dokploy host by setting a malicious custom Git URL and triggering deployment. The vulnerability is fixed in Dokploy version 0.29.13. Dokploy administrators and users with application access should verify their exposure and update or apply mitigations as necessary. The CVE record and NVD entry provide details on the vulnerability in Dokploy, a free, self-hostable Platform as a Service (PaaS).

Defensive priority

High

Recommended defensive actions

• Review and update Dokploy installations to version 0.29.13 or later
• Restrict access to authenticated users with application access
• Monitor for suspicious deployment activities and custom Git URL changes
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Dokploy, a free, self-hostable Platform as a Service (PaaS). The vulnerability exists in the cloneGitRepository function in packages/server/src/utils/providers/git.ts, allowing an authenticated user with application access to execute arbitrary operating system commands by setting a malicious custom Git URL and triggering deployment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.