CVE-2026-72885: Dokploy: Authenticated Command Injection in Dokploy Dockerfile Builder
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, dockerContextPath accepted by apps/dokploy/components/dashboard/application/build/show.tsx flows through getDockerContextPath in packages/server/src/utils/filesystem/directory.ts into the unquoted cd command in packages/server/src/utils/builders/docker-file.ts before execution by execAsync, allowing an authenticated application editor to execute arbitrary commands on the Dokploy host. This issue is fixed in version 0.29.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokployto a version that resolves this vulnerability.Fixed in 0.29.13
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72885?
CVE-2026-72885 has a risk score of 66, indicating a medium severity for the authenticated command injection vulnerability in Dokploy.
How do I fix CVE-2026-72885?
To fix CVE-2026-72885, update Dokploy to version 0.29.13 or later where the vulnerability has been addressed.
What components are affected by CVE-2026-72885?
CVE-2026-72885 affects the Dockerfile builder used in Dokploy prior to version 0.29.13.
What type of vulnerability is CVE-2026-72885?
CVE-2026-72885 is classified as an OS Command Injection vulnerability.
Can CVE-2026-72885 be exploited remotely?
Yes, CVE-2026-72885 can be exploited by authenticated users to execute arbitrary commands on the server.