CVE-2026-72875: Dokploy: Remote Code Execution (RCE) via Command Injection in settings.readTraefikFile
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, settings.readTraefikFile in apps/dokploy/server/api/routers/settings.ts passes a path accepted by apiReadTraefikConfig to readConfigInPath in packages/server/src/utils/traefik/application.ts, where configPath is interpolated into execAsyncRemote as cat ${configPath}, allowing a user with traefikFiles.read permission to execute arbitrary commands on a managed server through shell metacharacters. This issue is fixed in version 0.29.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokployto a version that resolves this vulnerability.Fixed in 0.29.13 - Configuration
Limit the users/roles that have the traefikFiles.read permission to reduce who can exploit the settings.readTraefikFile → apiReadTraefikConfig → readConfigInPath path before upgrading to 0.29.13.
Dokploy (Traefik file handling) traefikFiles.read permission = restrict to trusted users/roles only
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72875?
The severity of CVE-2026-72875 is classified as high with a score of 8.8.
How do I fix CVE-2026-72875?
To mitigate CVE-2026-72875, update Dokploy to version 0.29.13 or later.
What type of vulnerability is CVE-2026-72875?
CVE-2026-72875 is classified as a Remote Code Execution (RCE) vulnerability due to command injection.
Which software is affected by CVE-2026-72875?
CVE-2026-72875 affects the Dokploy software prior to version 0.29.13.
What impacts does CVE-2026-72875 have on system security?
CVE-2026-72875 can allow an attacker to execute arbitrary commands on the server, posing a significant security risk.