What is the CVSS score of CVE-2026-72878?

CVE-2026-72878 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Dokploy are affected by CVE-2026-72878?

Dokploy self-hosted deployments are vulnerable to command execution attacks by administrative users, enabling full compromise of underlying host infrastructure.. A patch is available.

How to fix or mitigate CVE-2026-72878?

Within 24 hours: Identify all Dokploy deployments and document current versions; audit administrative account activities in affected versions for unauthorized command execution or suspicious processes. Within 7 days: Upgrade all Dokploy instances to version 0.29.13 or later across all environments, and revoke or rotate any administrative credentials that had access during the vulnerable window. Within 30 days: Complete forensic analysis of all host systems where Dokploy was deployed to identify unauthorized access or data exfiltration; implement network segmentation and principle-of-least-privilege restrictions on administrative accounts.

Dokploy CVE-2026-72878

EUVD-2026-55744 CRITICAL

OS Command Injection (CWE-78)

2026-08-10 GitHub_M

Command Injection Dokploy

9.6

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Requires an authenticated admin/owner account so PR:H; arbitrary host command execution escapes the app to the OS, giving S:C and full C/I/A:H including availability.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Aug 10, 2026 - 20:04 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 19:50 vuln.today

Analysis Generated

Aug 10, 2026 - 19:50 vuln.today

CVE Published

Aug 10, 2026 - 19:11 cve.org

CRITICAL 9.6

DescriptionCVE.org

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy's backup and restore pipeline constructs shell commands by directly interpolating user-controlled database fields into bash -c "..." and sh -c "..." strings, then executes them via child_process.exec(). An authenticated admin/owner can inject arbitrary OS commands that execute on the host machine running Dokploy (not just inside a container). This vulnerability is fixed in 0.29.13.

AnalysisAI

OS command injection in Dokploy self-hosted PaaS (versions prior to 0.29.13) lets an authenticated admin/owner execute arbitrary commands on the underlying host, not merely inside a managed container. The backup/restore, destination, volume-backup, certificate, and mount code paths build bash -c/sh -c strings by directly interpolating user-controlled, database-backed fields (S3 credentials, paths, volume names) and run them through child_process.exec(). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate as admin/owner

Delivery

Inject shell payload into backup/destination/volume field

Exploit

Trigger backup, restore, or list operation

Execution

child_process.exec runs crafted bash string

Persist

Execute arbitrary OS commands on host

Impact

Full host compromise