What is the CVSS score of CVE-2026-72735?

CVE-2026-72735 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Dokploy are affected by CVE-2026-72735?

Dokploy versions before 0.29.13 contain a critical command injection vulnerability enabling authenticated panel users to execute arbitrary commands on managed remote servers through malicious Traefik…. A patch is available.

How to fix or mitigate CVE-2026-72735?

Within 24 hours: identify all Dokploy deployments in production and their versions, restrict panel user access to essential administrators only, and audit recent Traefik configuration changes for anomalies. Within 7 days: implement network segmentation to restrict SSH egress from Dokploy servers to only necessary remote hosts, and enable command-level audit logging on managed remote servers. Within 30 days: monitor vendor channels for patched version release and develop upgrade plan; until patched, maintain restrictive access controls and implement application-level input validation for Traefik configuration fields to prevent single-quote injection attacks.

Dokploy CVE-2026-72735

EUVD-2026-55681 CRITICAL

Command Injection (CWE-77)

2026-08-10 GitHub_M

Command Injection Dokploy

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable panel with low-complexity injection, but an authenticated config-editing account is required (PR:L); command execution on separate managed servers is a scope change (S:C) with full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 10, 2026 - 19:03 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 18:31 vuln.today

Analysis Generated

Aug 10, 2026 - 18:31 vuln.today

CVE Published

Aug 10, 2026 - 17:34 cve.org

CRITICAL 9.9

DescriptionCVE.org

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed through execAsyncRemote. Single quotes in redirect regex and replacement fields, basic authentication usernames, domain host values, or middleware configuration can terminate the shell quoting and execute arbitrary commands on managed remote servers with the configured SSH user's privileges. This vulnerability is caused by an incomplete fix for CVE-2026-45630. This issue is fixed in version 0.29.13.

AnalysisAI

Command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated panel user run arbitrary commands on managed remote servers by embedding a single quote in Traefik configuration fields. The flaw sits in writeTraefikConfigRemote, which interpolates yaml.stringify output into an unsanitized 'echo '...' > file' shell command run over SSH via execAsyncRemote. It is a scope-changing (CVSS 9.9) issue and, notably, an incomplete fix for the earlier CVE-2026-45630; no public exploit is identified at time of analysis, though the fixing commit and advisory are public.

Technical ContextAI

Dokploy manages application deployments and generates Traefik reverse-proxy configuration for managed servers. The vulnerable code (packages/server/src/utils/traefik/application.ts) serializes user-controlled Traefik settings with yaml.stringify, then builds a shell command of the form 'echo '<yamlStr>' > <configPath>' and executes it on the remote host through execAsyncRemote (an SSH exec wrapper). Because the YAML string is placed inside single quotes with no escaping, any single quote in fields such as HTTP-to-HTTPS redirect regex/replacement, basic-auth usernames, domain host values, or middleware configuration terminates the shell quoting and injects attacker-controlled shell tokens. This is a classic CWE-77 (Command Injection) failure to neutralize special elements before passing data to a shell. The fix replaces the fragile echo/single-quote pattern with base64 encoding piped to 'base64 -d' and shell-quote's quote() for paths, eliminating the shell-metacharacter attack surface.

RemediationAI

Upgrade to Dokploy 0.29.13, which is the vendor-released patch that replaces the vulnerable 'echo '<yaml>' > file' pattern with base64-encoded input decoded via 'base64 -d' and shell-quote quoting of paths (commit 92310ddb143c8e67ca95eb7db661838a76579f2e; release https://github.com/Dokploy/dokploy/releases/tag/v0.29.13). Because this is an incomplete fix for CVE-2026-45630, confirm you are on 0.29.13 or later rather than an intermediate build. Until you can patch, restrict who holds Dokploy accounts with application/Traefik configuration privileges to fully trusted operators only, since any such user can inject commands - the trade-off is reduced delegation of deployment duties. Additionally, place the Dokploy panel behind network access controls / VPN so the authenticated interface is not broadly reachable (trade-off: less convenient remote administration), and, where feasible, run the SSH user Dokploy uses on managed servers with the least privilege necessary so a successful injection lands with reduced rights (trade-off: some deployment operations may require elevated access). Review advisory GHSA-478p-cx3j-hghc for authoritative guidance.