CVE-2026-72740: Dokploy: OS Command Injection via SSH-form `customGitUrl` domain in `ssh-keyscan`
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, packages/server/src/utils/providers/git.ts parses the user-controlled customGitUrl with sanitizeRepoPathSSH and interpolates its domain into the ssh-keyscan command from addHostToKnownHostsCommand without shell quoting, allowing an authenticated member with service deployment permission and an attached SSH key to execute arbitrary commands on the Dokploy host during deployment. This issue is fixed in version 0.29.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokployto a version that resolves this vulnerability.Fixed in 0.29.13
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72740?
The severity of CVE-2026-72740 is rated as critical with a score of 9.9.
How do I fix CVE-2026-72740?
To mitigate CVE-2026-72740, update to Dokploy version 0.29.13 or later.
What type of vulnerability is CVE-2026-72740?
CVE-2026-72740 is classified as an OS Command Injection vulnerability.
What components are affected by CVE-2026-72740?
CVE-2026-72740 affects the parsing of the user-controlled customGitUrl in Dokploy, specifically in the `ssh-keyscan` command execution.
Is user input involved in the exploitation of CVE-2026-72740?
Yes, exploitation of CVE-2026-72740 involves user-controlled input for the customGitUrl.