CVE-2026-72880: Dokploy: Arbitrary File Write + Remote OS Command Injection via `certificatePath`
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the apiCreateCertificate schema in packages/server/src/db/schema/certificate.ts accepts a client-supplied certificatePath, and packages/server/src/services/certificate.ts joins that value to the certificate root without confinement. An authenticated user with certificate create or delete permission can use certificatePath to write attacker-controlled certificate content outside the intended directory or delete an out-of-root directory. This vulnerability is fixed in 0.29.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
dokployto a version that resolves this vulnerability.Fixed in 0.29.13
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72880?
CVE-2026-72880 has a critical severity score of 9.9.
What are the risks associated with CVE-2026-72880?
CVE-2026-72880 poses risks of arbitrary file write and remote OS command injection.
How do I fix CVE-2026-72880?
To fix CVE-2026-72880, upgrade Dokploy to version 0.29.13 or later.
What versions of Dokploy are affected by CVE-2026-72880?
CVE-2026-72880 affects all versions of Dokploy prior to 0.29.13.
What can be exploited in CVE-2026-72880?
CVE-2026-72880 allows exploitation through a client-supplied certificatePath leading to potential OS command injection.