CVE-2026-72884 Dokploy CVE debrief

Who should care

Administrators and users of Dokploy, especially those with access to update Compose services, should assess their exposure and apply the patch to prevent command injection attacks.

Why it matters

CVE-2026-72884 is a high-severity vulnerability in Dokploy that allows authenticated users to inject shell metacharacters and execute arbitrary commands on the Dokploy host. Defenders should assess exposure, apply the patch, and monitor for suspicious activity.

• Authenticated users with update access to Compose services may be able to execute arbitrary commands on the Dokploy host
• Successful exploitation could lead to unauthorized command execution and potential system compromise
• Defenders should verify that the Dokploy host is not vulnerable to arbitrary command execution
• Remediation priority is high, as patching to version 0.29.13 can prevent the issue

Technical summary

CVE-2026-72884 is a high-severity vulnerability in Dokploy, a free, self-hostable Platform as a Service (PaaS). The vulnerability exists in the sanitizeCommand function in packages/server/src/utils/builders/compose.ts, which only trims whitespace and strips surrounding quotes from compose.command before exportEnvCommand and docker command interpolation. This allows an authenticated user who can update a Compose service to inject shell metacharacters and execute arbitrary commands on the Dokploy host.

Defensive priority

High

Recommended defensive actions

• Review and apply the patch (version 0.29.13) to prevent command injection attacks
• Verify that the Dokploy host is not vulnerable to arbitrary command execution
• Monitor for suspicious activity on the Dokploy host
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. The Dokploy team has released a fixed version (0.29.13) and provided source references for the issue. The vulnerability allows authenticated users with update access to Compose services to inject shell metacharacters and execute arbitrary commands on the Dokploy host. The Dokploy team has provided source references for the issue, including a commit fixing the issue, a pull request addressing the issue, and release notes for the fixed version. Defenders should verify

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.