CVE-2026-72735: Dokploy: Command injection in writeTraefikConfigRemote via shell interpolation of unescaped YAML in SSH remote execution
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed through execAsyncRemote. Single quotes in redirect regex and replacement fields, basic authentication usernames, domain host values, or middleware configuration can terminate the shell quoting and execute arbitrary commands on managed remote servers with the configured SSH user's privileges. This vulnerability is caused by an incomplete fix for CVE-2026-45630. This issue is fixed in version 0.29.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokployto a version that resolves this vulnerability.Fixed in 0.29.13
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72735?
The severity of CVE-2026-72735 is critical with a score of 9.9.
What type of vulnerability is CVE-2026-72735?
CVE-2026-72735 is a command injection vulnerability.
How do I fix CVE-2026-72735?
To fix CVE-2026-72735, update Dokploy to version 0.29.13 or later.
What component is affected by CVE-2026-72735?
CVE-2026-72735 affects the writeTraefikConfigRemote function in Dokploy.
Can CVE-2026-72735 lead to remote code execution?
Yes, CVE-2026-72735 can lead to remote code execution due to command injection.