CVE-2026-72867: Dokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose.ts)
Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch, branch, gitlabBranch, bitbucketBranch, or giteaBranch. A low-privileged authenticated user can trigger compose.deploy, which passes the stored branch to shell-based Git clone commands in packages/server/src/utils/providers/git.ts, github.ts, gitlab.ts, bitbucket.ts, and gitea.ts, resulting in arbitrary host command execution. This issue is fixed in version 0.29.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokployto a version that resolves this vulnerability.Fixed in 0.29.13 - Compensating control
Until upgraded to 0.29.13, restrict compose.update/compose.deploy actions so that low-privileged authenticated users cannot submit or trigger compose deployment using unvalidated branch fields.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72867?
The severity of CVE-2026-72867 is critical with a CVSS score of 9.9.
What types of vulnerabilities are associated with CVE-2026-72867?
CVE-2026-72867 is associated with input validation and OS command injection vulnerabilities.
How do I fix CVE-2026-72867?
To fix CVE-2026-72867, ensure server-side validation is implemented properly in the compose.ts file for branch fields.
What impact does CVE-2026-72867 have on Dokploy?
CVE-2026-72867 allows attackers to exploit unvalidated branch fields, potentially leading to malicious command execution.
Which versions of Dokploy are affected by CVE-2026-72867?
Dokploy versions from 0.29.3 to 0.29.13 are affected by CVE-2026-72867 due to incomplete validation.