CVE-2026-72865: Dokploy: OS Command Injection via compose `composePath`
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the compose.update operation stores an unvalidated composePath that packages/server/src/utils/builders/compose.ts and packages/server/src/services/compose.ts interpolate into docker compose -f, docker stack deploy -c, and touch shell commands executed through /bin/sh -c. An authenticated member with compose write and deploy permission can supply a crafted composePath, trigger compose.deploy or startCompose, and execute arbitrary operating-system commands in the Docker-privileged Dokploy host context. This issue is fixed in version 0.29.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokployto a version that resolves this vulnerability.Fixed in 0.29.13
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72865?
CVE-2026-72865 has a critical severity rating of 9.9.
How do I fix CVE-2026-72865?
To fix CVE-2026-72865, upgrade Dokploy to version 0.29.13 or later.
What type of vulnerability is CVE-2026-72865?
CVE-2026-72865 is classified as an OS Command Injection vulnerability.
What impact can CVE-2026-72865 have on my system?
CVE-2026-72865 can allow an attacker to execute arbitrary commands on the system.
What component of Dokploy is affected by CVE-2026-72865?
CVE-2026-72865 affects the compose.update operation in Dokploy.