What is the CVSS score of CVE-2026-72739?

CVE-2026-72739 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-72739?

Yes, a patch is available for CVE-2026-72739. Update the affected software to the latest version immediately.

Dokploy CVE-2026-72739

Q: Which versions of Dokploy are affected by CVE-2026-72739?

Command injection in Dokploy's `createCommand()` function allows authenticated users with compose deployment access to execute arbitrary OS commands on the underlying Docker host.. A patch is available.

EUVD-2026-55687 MEDIUM

OS Command Injection (CWE-78)

2026-08-10 GitHub_M

Docker Command Injection Dokploy

6.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

9.9 CRITICAL

Arbitrary host OS command execution via compose deployment requires only authenticated low-privileged access; scope changes because exploitation escapes the Dokploy app to the Docker host, yielding full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Aug 10, 2026 - 19:03 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 18:38 vuln.today

Analysis Generated

Aug 10, 2026 - 18:38 vuln.today

DescriptionCVE.org

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the createCommand() function constructs shell commands by interpolating compose service names and configuration into bash command strings. When a compose with a maliciously crafted name or service definition is deployed, the shell metacharacters are interpreted as command separators, allowing arbitrary command execution on the Docker host. This vulnerability is fixed in 0.29.13.

AnalysisAI

Command injection in Dokploy's createCommand() function allows authenticated users with compose deployment access to execute arbitrary OS commands on the underlying Docker host. All Dokploy releases before 0.29.13 are affected via CPE cpe:2.3:a:dokploy:dokploy:*. The official CVSS score of 6.5 with C:H/I:N/A:N materially understates actual impact - successful exploitation yields full host-level command execution, not merely information disclosure. No public exploit identified at time of analysis, though working injection payloads are published directly in the fix commit's test suite.

Technical ContextAI

Dokploy (cpe:2.3:a:dokploy:dokploy:*:*:*:*:*:*:*:*) is a free, self-hosted PaaS that orchestrates Docker Compose and Docker Stack deployments. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The vulnerable createCommand() function in packages/server/src/utils/builders/compose.ts constructs bash command strings by directly interpolating user-controlled values - appName and composePath - without any escaping, producing strings like docker compose -p ${appName} -f ${path} up -d. The same flaw exists in startCompose() in packages/server/src/services/compose.ts. The fix applies the shell-quote library's quote() function around every user-controlled token and adds a regex blocklist ([;&|\$(){}<>\n\\]`) to reject shell control characters in custom compose command strings. The commit diff confirms both code paths were vulnerable and both are now patched.

RemediationAI

Upgrade to Dokploy v0.29.13 or later; this is the vendor-released patch confirmed by the GitHub release at https://github.com/Dokploy/dokploy/releases/tag/v0.29.13 and fix commit at https://github.com/Dokploy/dokploy/commit/d48037a80203bb0ecaec4f5653aef75fcfdb656d. Review the security advisory at https://github.com/Dokploy/dokploy/security/advisories/GHSA-5xv2-7f8w-9j5c for additional context. If immediate upgrade is not possible, restrict compose deployment permissions exclusively to fully trusted administrator accounts - removing compose creation and deployment access from any non-admin user eliminates the exploitable attack surface without requiring patching, though this may break legitimate multi-user workflows. Do not expose the Dokploy management interface to untrusted networks as a compensating control; this reduces the pool of potential attackers but does not address the underlying injection flaw for users who retain access.