CVE-2026-72872: Dokploy: OS Command Injection via Bitbucket `owner`/`repository` in `git clone`
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, application.saveBitbucketProvider stores bitbucketOwner and bitbucketRepository without validation and cloneBitbucketRepository in packages/server/src/utils/providers/bitbucket.ts interpolates those values into git clone commands executed through execAsync or execAsyncRemote, allowing a member with service deployment permission to execute arbitrary operating system commands on the Dokploy host or target server. This issue is fixed in version 0.29.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokployto a version that resolves this vulnerability.Fixed in 0.29.13
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72872?
CVE-2026-72872 has a severity rating of critical with a score of 9.9.
What type of vulnerability is CVE-2026-72872?
CVE-2026-72872 is categorized as an OS Command Injection vulnerability.
How do I fix CVE-2026-72872?
To remediate CVE-2026-72872, upgrade Dokploy to version 0.29.13 or later which includes the necessary validation fix.
What systems are affected by CVE-2026-72872?
CVE-2026-72872 affects versions of Dokploy prior to 0.29.13.
What impact does CVE-2026-72872 have?
Exploitation of CVE-2026-72872 could allow an attacker to execute arbitrary OS commands on the server.