CVE-2026-72874: Dokploy: Command Injection via Unescaped Git URL in Clone Commands
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, cloneGitRepository in packages/server/src/utils/providers/git.ts interpolates customGitUrl and customGitBranch into a git clone command passed to execAsync or execAsyncRemote, allowing an authenticated user with application access to execute arbitrary operating system commands on the Dokploy host by setting a malicious custom Git URL and triggering deployment. This issue is fixed in version 0.29.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokployto a version that resolves this vulnerability.Fixed in 0.29.13
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72874?
The severity of CVE-2026-72874 is rated at 73, indicating a significant risk.
How do I fix CVE-2026-72874?
To fix CVE-2026-72874, update Dokploy to version 0.29.13 or later.
What type of vulnerability is CVE-2026-72874?
CVE-2026-72874 is classified as an OS Command Injection vulnerability.
Who is affected by CVE-2026-72874?
Anyone using Dokploy versions prior to 0.29.13 may be affected by CVE-2026-72874.
What functionality does CVE-2026-72874 exploit?
CVE-2026-72874 exploits the command execution functionality in the cloneGitRepository by allowing unescaped Git URLs.