CVE-2026-72870: Dokploy: Command Injection via Docker Credentials in buildRemoteDocker
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the buildRemoteDocker() function in packages/server/src/utils/providers/docker.ts interpolates the application-controlled dockerImage value directly into a docker pull shell command. An authenticated user with project access can set a crafted dockerImage through application.update and trigger application.deploy, causing execAsync() to execute arbitrary operating-system commands as the Dokploy server process. This issue is fixed in version 0.29.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokployto a version that resolves this vulnerability.Fixed in 0.29.13
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72870?
CVE-2026-72870 has a risk severity score of 70.
How do I fix CVE-2026-72870?
To fix CVE-2026-72870, upgrade to Dokploy version 0.29.13 or later.
What type of vulnerability is CVE-2026-72870?
CVE-2026-72870 is classified as an OS Command Injection vulnerability.
Who is affected by CVE-2026-72870?
CVE-2026-72870 affects authenticated users with project access prior to version 0.29.13 of Dokploy.
What component of Dokploy is impacted by CVE-2026-72870?
CVE-2026-72870 affects the buildRemoteDocker() function in Dokploy's Docker integration.