CVE-2026-72901: Dokploy: Remote Code Execution via volume-backup
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated low-privilege member to execute arbitrary commands on the control-plane host because the volumeName field accepted by volumeBackup.create and volumeBackup.runManually is interpolated without quoting in packages/server/src/utils/volume-backups/backup.ts and executed through childprocess.exec, with Docker socket access making execution host/root-equivalent. This issue is fixed in version 0.29.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokployto a version that resolves this vulnerability.Fixed in 0.29.13
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72901?
The severity of CVE-2026-72901 is critical with a score of 9.9.
What type of vulnerability is described by CVE-2026-72901?
CVE-2026-72901 describes an OS Command Injection vulnerability in Dokploy.
How can I fix CVE-2026-72901?
To fix CVE-2026-72901, upgrade Dokploy to version 0.29.13 or later.
What does CVE-2026-72901 allow an attacker to do?
CVE-2026-72901 allows an authenticated low-privilege member to execute arbitrary commands on the control-plane host.
When was CVE-2026-72901 published?
CVE-2026-72901 was published on August 10, 2026.