CVE-2026-72869: Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCE
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription passes the databaseName parameter to restore builders in packages/server/src/utils/restore/utils.ts, where PostgreSQL, MariaDB, MySQL, and MongoDB commands embed the value in nested shell text executed by Node.js exec. An authenticated user with backup:restore permission can supply a crafted databaseName that the host /bin/sh expands before docker exec, resulting in arbitrary commands running in the Docker-privileged host context. This issue is fixed in version 0.29.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
dokployto a version that resolves this vulnerability.Fixed in 0.29.13
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72869?
The severity of CVE-2026-72869 is critical, with a CVSS score of 9.9.
How do I fix CVE-2026-72869?
To fix CVE-2026-72869, update Dokploy to version 0.29.13 or later.
What type of vulnerability is CVE-2026-72869?
CVE-2026-72869 is an authenticated OS command injection vulnerability.
What can be exploited in CVE-2026-72869?
CVE-2026-72869 can be exploited to achieve remote code execution on the host.
Which software is affected by CVE-2026-72869?
CVE-2026-72869 affects Dokploy versions prior to 0.29.13.