OS command injection in Dokploy volume-backup feature (CVE-2026-72901)

An OS command injection vulnerability in Dokploy's volume-backup feature allows any authenticated low-privilege member to execute arbitrary commands on the control-plane host. The `volumeName` field accepted by `volumeBackup.create` and `volumeBackup.runManually` is interpolated without quoting into a shell command string that is executed via `child_process.exec` (`/bin/sh -c`) with no server-side input sanitisation, enabling shell metacharacters to be evaluated on the host. Because the Dokploy process holds the Docker socket, exploitation yields full host/root-equivalent compromise. Affected versions: - < v0.29.12 We recommend updating to: v0.29.13. CVSS 9.9 · our assessment: act_now Reference: https://github.com/Dokploy/dokploy/security/advisories/GHSA-w223-vw9m-4f9c Details: https://vuln.today/cve/CVE-2026-72901