What is the CVSS score of CVE-2026-72738?

CVE-2026-72738 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Dokploy are affected by CVE-2026-72738?

Dokploy, a self-hosted platform-as-a-service solution, contains a critical command injection vulnerability in its backup functionality that allows authenticated users with minimal backup:read…. A patch is available.

How to fix or mitigate CVE-2026-72738?

Within 24 hours, immediately restrict assignment of backup:read permissions to only essential administrators and disable backup functionality if operationally feasible. Within 7 days, enable comprehensive audit logging for all backup operations and verify Dokploy's release notes to confirm whether version 0.29.13 or later contains a security patch for this vulnerability. Within 30 days, either apply the patch update if available or implement strict network segmentation isolating Dokploy hosts from other production systems to contain potential host compromise.

Dokploy CVE-2026-72738

EUVD-2026-55686 CRITICAL

OS Command Injection (CWE-78)

2026-08-10 GitHub_M

Command Injection Dokploy

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable authenticated endpoint (PR:L) with no user interaction and low complexity; app-to-OS command execution justifies scope change and full C/I/A host impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 10, 2026 - 19:03 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 18:33 vuln.today

Analysis Generated

Aug 10, 2026 - 18:33 vuln.today

CVE Published

Aug 10, 2026 - 17:49 cve.org

CRITICAL 9.9

DescriptionCVE.org

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.listBackupFiles tRPC endpoint in apps/dokploy/server/api/routers/backup.ts passes the search parameter through normalizeS3Path and interpolates it into an rclone lsjson command executed by child_process.exec(), allowing an authenticated user with backup:read permission to execute arbitrary commands on the Dokploy host. This issue is fixed in version 0.29.13.

AnalysisAI

Command injection in Dokploy self-hostable PaaS before 0.29.13 lets an authenticated user with backup:read permission run arbitrary OS commands on the Dokploy host. The backup.listBackupFiles tRPC endpoint routes an attacker-controlled search parameter through normalizeS3Path and interpolates it unescaped into an rclone lsjson string executed via child_process.exec(). No public exploit identified at time of analysis, but the root cause and fix are confirmed in the vendor commit and the CVSS 9.9 rating reflects full host compromise from a low-privilege application role.

Technical ContextAI

Dokploy is a Node.js/TypeScript Platform-as-a-Service used to deploy and manage applications, databases, and backups on a self-hosted server. The vulnerable code path builds a shell command line for rclone (a cloud-storage sync tool) to list S3 backup files, then executes it through child_process.exec(), which spawns /bin/sh -c and therefore interprets shell metacharacters. Because the user-supplied search value was placed inside a double-quoted argument with no escaping, characters such as ", $(...), backticks, or ; break out of the intended argument and become additional shell commands. This is the classic CWE-78 (OS Command Injection) pattern: untrusted input concatenated into a string handed to a shell interpreter. The vendor fix imports shell-quote and wraps every interpolated value (searchPath, S3 access key/secret/region/endpoint/provider, and multiple restore paths) with quote([...]), neutralizing the metacharacters across backup, destination, and restore routines.

RemediationAI

Vendor-released patch: upgrade Dokploy to 0.29.13 or later, which replaces the vulnerable string interpolation with shell-quote's quote() across the backup, destination, and restore command builders (fix commit eeb6e7b8ea88e4b4b1fac8460755464100516ac9; release https://github.com/Dokploy/dokploy/releases/tag/v0.29.13). If you cannot upgrade immediately, reduce exposure by revoking the backup:read permission from all non-trusted users and auditing which accounts currently hold it, since that permission is the entry condition; treat backup/destination management as an admin-only function until patched. As additional compensating controls, restrict network access to the Dokploy management UI/API to a trusted VPN or admin network so the authenticated endpoint is not broadly reachable, and monitor the host for unexpected child processes spawned from the Dokploy/rclone process tree. These controls reduce reachable attacker population but do not remove the underlying injection, so patching remains the only complete fix; review the GHSA-5vjv-73wr-rf79 advisory for vendor guidance.