CVE-2026-72875 Dokploy CVE debrief

Who should care

Defenders responsible for managing Dokploy instances should assess exposure and apply the patch to prevent exploitation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure, apply the patch, and monitor for suspicious activity.

Why it matters

Defenders should prioritize verifying exposure and applying the patch, as the vulnerability allows for arbitrary command execution on managed servers through shell metacharacters, potentially leading to lateral movement, data breaches, or system compromise.

• Arbitrary command execution on managed servers
• Potential for lateral movement and further exploitation
• Need for verification of exposure and application of the patch
• Potential for data breaches or system compromise

Technical summary

The vulnerability is caused by the settings.readTraefikFile function in apps/dokploy/server/api/routers/settings.ts, which passes a path accepted by apiReadTraefikConfig to readConfigInPath in packages/server/src/utils/traefik/application.ts. This allows for shell metacharacters to be injected, enabling arbitrary command execution. The affected product context is Dokploy, a free, self-hostable Platform as a Service (PaaS). The defensive impact is that defenders should prioritize verifying exposure and applying the patch to prevent exploitation.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as the vulnerability allows for arbitrary command execution.

Recommended defensive actions

• Verify exposure by checking if the Dokploy instance has the traefikFiles.read permission and if the version is prior to 0.29.13.
• Apply the patch by updating Dokploy to version 0.29.13 or later.
• Monitor for suspicious activity and implement compensating controls to prevent exploitation.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is caused by the settings.readTraefikFile function in apps/dokploy/server/api/routers/settings.ts, which passes a path accepted by apiReadTraefikConfig to readConfigInPath in packages/server/src/utils/traefik/application.ts. This allows for shell metacharacters to be injected, enabling arbitrary command execution.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.