What is the CVSS score of CVE-2026-72880?

CVE-2026-72880 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Dokploy are affected by CVE-2026-72880?

Dokploy versions prior to 0.29.13 contain a critical vulnerability allowing any user with certificate management permissions to execute arbitrary commands on the underlying host infrastructure.. A patch is available.

How to fix or mitigate CVE-2026-72880?

Within 24 hours, audit all users and service accounts holding certificate management permissions in Dokploy and assess whether each individual requires these privileges. Within 7 days, upgrade all Dokploy instances to version 0.29.13 or later after validating the upgrade path in your staging environment. Within 30 days, implement principle-of-least-privilege access controls restricting certificate management permissions to essential personnel only, enable comprehensive audit logging for all certificate operations, and review access logs from the past 90 days for suspicious certificate management activity.

Dokploy CVE-2026-72880

EUVD-2026-55788 CRITICAL

OS Command Injection (CWE-78)

2026-08-10 GitHub_M

Command Injection Dokploy

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable web action, low complexity, but requires an authenticated certificate permission (PR:L); shell injection escapes the app to the host OS (S:C) with full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 10, 2026 - 21:05 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 20:01 vuln.today

Analysis Generated

Aug 10, 2026 - 20:01 vuln.today

CVE Published

Aug 10, 2026 - 19:19 cve.org

CRITICAL 9.9

DescriptionCVE.org

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the apiCreateCertificate schema in packages/server/src/db/schema/certificate.ts accepts a client-supplied certificatePath, and packages/server/src/services/certificate.ts joins that value to the certificate root without confinement. An authenticated user with certificate create or delete permission can use certificatePath to write attacker-controlled certificate content outside the intended directory or delete an out-of-root directory. This vulnerability is fixed in 0.29.13.

AnalysisAI

Server-side command injection and path traversal in Dokploy, a self-hostable Platform-as-a-Service, allows an authenticated user holding certificate create or delete permission to supply a crafted certificatePath that is concatenated into shell commands without confinement or escaping. In versions before 0.29.13, this permits writing attacker-controlled content outside the certificate root, deleting arbitrary out-of-root directories, and - because the value reaches unquoted shell invocations (echo ... base64 -d > path, rm -rf certDir) - executing operating-system commands on the host. No public exploit has been identified at time of analysis, though the fixing pull request and commit are public; the flaw is fixed in 0.29.13.

Technical ContextAI

Dokploy (cpe:2.3:a:dokploy:dokploy) is a Node.js/TypeScript self-hosted PaaS that manages TLS certificates by shelling out to a remote host. The apiCreateCertificate Zod schema in packages/server/src/db/schema/certificate.ts accepts a client-supplied certificatePath, and packages/server/src/services/certificate.ts uses it to build a certificate directory that is then interpolated directly into shell strings executed via execAsyncRemote (e.g. 'mkdir -p ${certDir}', 'echo "..." | base64 -d > "${crtPath}"', and 'rm -rf ${certDir}'). This is classified CWE-78 (OS Command Injection): because the path is neither confined to the root nor shell-escaped, both directory-traversal sequences and shell metacharacters in certificatePath are honored. The fix wraps every interpolated path in shell-quote's quote() across certificate.ts, mount.ts, backup.ts, and destination.ts, and adds a VOLUME_NAME_REGEX allowlist for related volume operations - confirming the root cause was unsanitized user input flowing into shell commands.

RemediationAI

Vendor-released patch: 0.29.13 - upgrade every Dokploy instance to v0.29.13 or later, per the release at https://github.com/Dokploy/dokploy/releases/tag/v0.29.13 and advisory GHSA-q9qw-ch66-5hw3. If immediate upgrade is not possible, the highest-value compensating control is to restrict who holds certificate create and delete permissions to a minimal set of fully trusted administrators, since exploitation requires that permission (side effect: other users lose self-service certificate management). Additionally, place the Dokploy management interface behind a VPN or IP allowlist to shrink the reachable attacker population, and audit certificate records for suspicious certificatePath values or unexpected files written outside the certificate root. These are stopgaps only; because the flaw is server-side shell injection, no configuration flag fully neutralizes it, and the code-level fix (shell-quote quoting introduced in PR #4873) is the sole complete remedy.