CVE-2026-72739: Dokploy: Command Injection via Compose Shell Execution
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the createCommand() function constructs shell commands by interpolating compose service names and configuration into bash command strings. When a compose with a maliciously crafted name or service definition is deployed, the shell metacharacters are interpreted as command separators, allowing arbitrary command execution on the Docker host. This vulnerability is fixed in 0.29.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokployto a version that resolves this vulnerability.Fixed in 0.29.13
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72739?
CVE-2026-72739 has a medium severity rating of 6.5.
How do I fix CVE-2026-72739?
To fix CVE-2026-72739, upgrade to Dokploy version 0.29.13 or later.
What type of vulnerability is CVE-2026-72739?
CVE-2026-72739 is classified as an OS Command Injection vulnerability.
What software is affected by CVE-2026-72739?
CVE-2026-72739 affects Dokploy prior to version 0.29.13.
What can an attacker achieve by exploiting CVE-2026-72739?
An attacker can execute arbitrary commands on the server through command injection via maliciously crafted compose service names.