CVE-2026-72885 Dokploy CVE debrief

Who should care

Administrators and users of Dokploy should assess their exposure and take necessary actions to mitigate the vulnerability. This includes reviewing current version and exposure, planning vendor-supported updates or mitigations, and restricting access to the Dokploy dashboard. Affected operator, platform, vulnerability-management, and security-team impact should be considered.

Why it matters

CVE-2026-72885 is a high-severity command injection vulnerability in Dokploy that allows authenticated application editors to execute arbitrary commands on the host. This vulnerability requires immediate attention to prevent potential exploitation.

• Potential for arbitrary command execution on the Dokploy host
• Elevation of privileges for authenticated application editors
• Possible lateral movement within the network
• Need for verification of current version and exposure

Technical summary

CVE-2026-72885 is a command injection vulnerability in Dokploy, a free, self-hostable Platform as a Service (PaaS). The vulnerability exists in the dockerContextPath accepted by apps/dokploy/components/dashboard/application/build/show.tsx, which flows through getDockerContextPath in packages/server/src/utils/filesystem/directory.ts into the unquoted cd command in packages/server/src/utils/builders/docker-file.ts before execution by execAsync. This allows an authenticated application editor to execute arbitrary commands on the Dokploy host.

Defensive priority

High

Recommended defensive actions

• Upgrade Dokploy to version 0.29.13 or later
• Restrict access to the Dokploy dashboard
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. The Dokploy application is affected by a command injection vulnerability prior to version 0.29.13. The vulnerability allows an authenticated application editor to execute arbitrary commands on the Dokploy host. Evidence is limited to the CVE record, NVD entry, and Dokploy version 0.29.13. Defenders should verify current version and exposure, review official advisory for affected scope and severity, and plan vendor-supported updates or mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.