CVE-2026-72884: Dokploy: Command Injection via Compose Custom Command
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, sanitizeCommand in packages/server/src/utils/builders/compose.ts only trims whitespace and strips surrounding quotes from compose.command before exportEnvCommand and docker command interpolation, allowing an authenticated user who can update a Compose service to inject shell metacharacters and execute arbitrary commands on the Dokploy host. This issue is fixed in version 0.29.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokployto a version that resolves this vulnerability.Fixed in 0.29.13
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72884?
CVE-2026-72884 has a risk score of 73, indicating a significant vulnerability.
How do I fix CVE-2026-72884?
To fix CVE-2026-72884, update Dokploy to version 0.29.13 or later where the vulnerability has been addressed.
What type of vulnerability is CVE-2026-72884?
CVE-2026-72884 is classified as an OS Command Injection vulnerability.
Who is affected by CVE-2026-72884?
Users of Dokploy prior to version 0.29.13 are affected by CVE-2026-72884.
What is the impact of CVE-2026-72884?
CVE-2026-72884 allows an authenticated user to exploit command injection through Compose Custom Commands.