CVE-2026-72881: Dokploy: Command Injection via database credentials in backup/restore commands
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, database backup and restore command builders in packages/server/src/utils/backups/utils.ts and packages/server/src/utils/restore/utils.ts interpolate database names, usernames, and passwords into nested shell command strings passed to childprocess.exec(). An authenticated administrator with permission to create databases and configure backups can use crafted database configuration fields to execute arbitrary commands inside PostgreSQL, MariaDB, MySQL, MongoDB, or LibSQL containers, exposing database data and credentials and potentially enabling escape when a container is overprivileged. This issue is fixed in version 0.29.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokployto a version that resolves this vulnerability.Fixed in 0.29.13
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72881?
CVE-2026-72881 has a risk score of 57, indicating a moderate severity level.
What software is affected by CVE-2026-72881?
CVE-2026-72881 affects Dokploy versions prior to 0.29.13.
How do I fix CVE-2026-72881?
To mitigate CVE-2026-72881, update Dokploy to version 0.29.13 or later.
What type of vulnerability is CVE-2026-72881?
CVE-2026-72881 is classified as an OS Command Injection vulnerability.
What does CVE-2026-72881 exploit?
CVE-2026-72881 exploits command injection via database credentials in backup and restore commands.