CVE-2026-72882 Dokploy CVE debrief

Who should care

Defenders responsible for Dokploy installations, particularly those using version 0.28.8 or earlier, should assess exposure and prioritize remediation. System administrators and security teams managing PaaS environments need to verify their inventory and apply necessary updates or compensating controls.

Why it matters

CVE-2026-72882 is a critical vulnerability in Dokploy that allows authenticated users to execute arbitrary commands on remote managed servers. Defenders should prioritize remediation, especially in environments where Dokploy is used. The vulnerability's impact includes potential RCE, privilege escalation, and lateral movement. Verification of Dokploy versions and configurations is necessary.

• Potential for remote code execution on managed servers
• Elevation of privileges for authenticated users
• Possible lateral movement within the network
• Need for verification of Dokploy version and configuration

Technical summary

CVE-2026-72882 is a critical vulnerability in Dokploy, a free, self-hostable Platform as a Service (PaaS). In versions 0.28.8 and earlier, an authenticated user can inject shell metacharacters into filePath when creating or updating file mounts for a service. This allows the execution of attacker-controlled commands on the configured remote managed server over SSH. In the default deployment model, this results in direct remote host RCE from the web interface.

Defensive priority

High

Recommended defensive actions

• Review and update Dokploy installations to ensure the latest version is used
• Restrict access to file mounts and SSH configurations for Dokploy services
• Monitor Dokploy logs for suspicious activity related to file mounts and SSH connections
• Verify Dokploy version and configuration
• Implement compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Review relevant monitoring, detection, and logs for exposed assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Dokploy 0.28.8 and earlier, allowing authenticated users to inject shell metacharacters and execute commands on remote managed servers over SSH.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.