CVE-2026-72880 Dokploy CVE debrief

Who should care

Administrators and users of Dokploy instances, particularly those with certificate creation or deletion permissions, should assess exposure and apply the patch in version 0.29.13. They should also restrict certificate creation and deletion permissions to necessary roles and monitor certificate creation and deletion activities for suspicious behavior. Additionally, defenders should verify the patch application and review compensating controls for exposed

Why it matters

CVE-2026-72880 is a critical path traversal vulnerability in Dokploy that allows an authenticated user to write attacker-controlled certificate content outside the intended directory. Defenders should care because it can lead to unauthorized certificate modification and potential system compromise. Administrators and users of Dokploy instances, particularly those with certificate creation or deletion permissions, should assess exposure and apply the patch in version 0.29.13. The vulnerability's impact is supported by the CVE record and NVD entry, but further verification is needed to determine the full scope of affected versions and remediation status.

• Potential for unauthorized certificate content modification
• Possible deletion of out-of-root directories
• Need for verification of affected versions and remediation status
• Requirement for monitoring and restricting certificate creation and deletion activities

Technical summary

The Dokploy apiCreateCertificate schema in packages/server/src/db/schema/certificate.ts accepts a client-supplied certificatePath, which is then joined to the certificate root without confinement. This allows an authenticated user with certificate create or delete permission to write attacker-controlled certificate content outside the intended directory or delete an out-of-root directory. The vulnerability is fixed in version 0.29.13, and defenders should review and apply this patch immediately. The CVE record and NVD entry provide additional technical context.

Defensive priority

High

Recommended defensive actions

• Review and apply the patch in version 0.29.13
• Restrict certificate creation and deletion permissions to necessary roles
• Monitor certificate creation and deletion activities for suspicious behavior
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the Dokploy path traversal vulnerability. The vulnerability is fixed in version 0.29.13. Further verification is needed to determine the full scope of affected versions and remediation status. Defenders should verify the patch application and monitor certificate creation and deletion activities for suspicious behavior. The CVE record was published on 2026-08-10T20:17:34.560Z and has not been modified since then. The official CVE Program record and NVD detail page offer additional context

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.