CVE-2026-72862: Dokploy: OS Command Injection via dockerImage field in database service deployment functions → HOST RCE
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts Dokploy database service deployment functions pass user-controlled dockerImage fields unquoted into docker pull ${dockerImage} shell commands on the remote-server code path. This vulnerability is fixed in 0.29.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokployto a version that resolves this vulnerability.Fixed in 0.29.13
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72862?
CVE-2026-72862 has a severity rating of critical with a base score of 9.9.
What type of vulnerability is CVE-2026-72862?
CVE-2026-72862 is an OS Command Injection vulnerability that can lead to remote code execution.
How do I fix CVE-2026-72862?
To fix CVE-2026-72862, upgrade Dokploy to version 0.29.13 or later where the vulnerability has been addressed.
What impacts can CVE-2026-72862 have on a system?
CVE-2026-72862 can potentially allow an attacker to execute arbitrary commands on the host system.
Who is affected by CVE-2026-72862?
CVE-2026-72862 affects users of Dokploy versions prior to 0.29.13 using the specified database service deployment functions.