CVE-2026-72878 Dokploy CVE debrief

Who should care

Administrators and owners of Dokploy installations should assess exposure and prioritize remediation due to the critical severity of this vulnerability. This includes reviewing and updating Dokploy installations to version 0.29.13 or later, restricting access to Dokploy's backup and restore functionality, and monitoring Dokploy logs for suspicious activity. Additionally, defenders should verify Dokploy version and exposure, and implement additional mitigi

Why it matters

CVE-2026-72878 is a critical command injection vulnerability in Dokploy that allows authenticated admin/owners to inject arbitrary OS commands on the host machine. Defenders should prioritize remediation and verify exposure, as exploitation could lead to significant disruption and potential lateral movement.

• Potential for arbitrary OS command execution on the host machine
• Possible disruption of Dokploy service
• Need for verification of Dokploy version and exposure
• Potential for lateral movement within the network

Technical summary

The Dokploy application is vulnerable to command injection due to improper handling of user-controlled database fields in its backup and restore pipeline. An authenticated admin/owner can inject arbitrary OS commands that execute on the host machine running Dokploy. The vulnerability is fixed in version 0.29.13. This issue arises from Dokploy's use of bash -c and sh -c strings, which are constructed by directly interpolating user-controlled database fields into command execution via child_process.exec(). Defenders should prioritize remediation and verify exposure, as exploitation could lead to significant disruption and potential lateral movement.

Defensive priority

High

Recommended defensive actions

• Review and update Dokploy installations to version 0.29.13 or later
• Restrict access to Dokploy's backup and restore functionality
• Monitor Dokploy logs for suspicious activity
• Implement additional security measures to detect and prevent command injection attacks
• Verify Dokploy version and exposure
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the Dokploy vulnerability, including its CVSS score and severity. However, the corpus does not establish specific exploitation instances or impact beyond potential command injection.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.