What is the CVSS score of CVE-2026-72865?

CVE-2026-72865 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Dokploy are affected by CVE-2026-72865?

Dokploy self-hosted PaaS versions prior to 0.29.13 enable authenticated project members with compose permissions to execute arbitrary commands on Docker-privileged hosts through unvalidated file path…. A patch is available.

How to fix or mitigate CVE-2026-72865?

Within 24 hours: audit all Dokploy deployments for versions prior to 0.29.13; enumerate users holding project member status with compose write/deploy permissions; implement emergency access restrictions limiting these permissions to only absolutely critical, explicitly-approved users. Within 7 days: verify current patch status with Dokploy vendor and upgrade to fixed version if available; if no patch released, maintain restricted permissions and deploy comprehensive audit logging of compose operations. Within 30 days: implement role-based access control framework for compose permissions requiring manager approval; deploy real-time alerting on docker compose command execution; conduct security review of team member privilege elevation procedures.

Dokploy CVE-2026-72865

EUVD-2026-55723 CRITICAL

OS Command Injection (CWE-78)

2026-08-10 GitHub_M

Docker Command Injection Dokploy

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network API reachable (AV:N), no special conditions (AC:L), requires an authenticated member with compose/deploy rights (PR:L), no interaction (UI:N); command execution breaks out of the app into the Docker-privileged host (S:C) with full C/I/A loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 10, 2026 - 20:04 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 19:27 vuln.today

Analysis Generated

Aug 10, 2026 - 19:27 vuln.today

CVE Published

Aug 10, 2026 - 18:33 cve.org

CRITICAL 9.9

DescriptionCVE.org

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the compose.update operation stores an unvalidated composePath that packages/server/src/utils/builders/compose.ts and packages/server/src/services/compose.ts interpolate into docker compose -f, docker stack deploy -c, and touch shell commands executed through /bin/sh -c. An authenticated member with compose write and deploy permission can supply a crafted composePath, trigger compose.deploy or startCompose, and execute arbitrary operating-system commands in the Docker-privileged Dokploy host context. This issue is fixed in version 0.29.13.

Articles & Coverage 1

News Critical OS Command Injection in Dokploy Self-Hosted PaaS - CVE-2026-72865 Aug 10, 2026

AnalysisAI

OS command injection in Dokploy self-hosted PaaS prior to 0.29.13 lets an authenticated project member with compose write and deploy permissions execute arbitrary commands on the Docker-privileged host. The compose.update operation persists an unvalidated composePath that is later interpolated verbatim into docker compose -f, docker stack deploy -c, and touch commands run via /bin/sh -c, so a crafted path fires shell metacharacters when the compose is deployed. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the upstream regression test suite demonstrates working injection payloads, making the path to exploitation well-understood.

Technical ContextAI

Dokploy is a Heroku/Vercel-style open-source platform-as-a-service that orchestrates Docker containers and Swarm stacks on a host it controls with privileged Docker access. The flaw is a classic CWE-78 OS Command Injection: user-controllable string fields (composePath, appName, and env file path) flow from the compose.update API into command builders in packages/server/src/utils/builders/compose.ts and packages/server/src/services/compose.ts, where they are string-concatenated into shell command lines (docker compose -p <appName> -f <path> up -d, docker stack deploy -c <path> <appName>, and touch <envFilePath>) that are executed through /bin/sh -c. Because no escaping was applied, shell control characters in these fields break out of the intended docker invocation. The fix wraps every interpolated value with shell-quote's quote() and additionally rejects any custom compose command containing the metacharacter set [;&|\$(){}<>\n\\]`. CPE cpe:2.3:a:dokploy:dokploy:*:*:*:*:*:*:*:* confirms the Dokploy application itself is the affected component.

RemediationAI

Vendor-released patch: upgrade to Dokploy 0.29.13 (release https://github.com/Dokploy/dokploy/releases/tag/v0.29.13), which introduces shell-quote escaping of composePath, appName, and env-file paths plus a metacharacter denylist on custom compose commands, per advisory GHSA-8r5w-vqjr-8c44 and PR #4863. Upgrading is the definitive fix and should be prioritized. Until you can patch, the actionable compensating control is to tightly restrict who holds compose write and deploy permissions - revoke deploy/compose-write from all but fully trusted operators, since the exploit is gated on that permission (trade-off: legitimate self-service deploys by team members are blocked). Additionally audit existing compose configurations for anomalous composePath values containing shell metacharacters (;, |, &, backticks, $(), and monitor the Dokploy host for unexpected child processes of /bin/sh -c under the docker deploy flow; these detective controls do not prevent injection but can catch abuse. Given the host runs with privileged Docker access, treat any suspected exploitation as full host compromise and rebuild accordingly.