Is there a patch available for EUVD-2026-55789?

Yes, a patch is available for EUVD-2026-55789. Update the affected software to the latest version immediately.

Dokploy EUVD-2026-55789

Q: What is the CVSS score of EUVD-2026-55789?

EUVD-2026-55789 has a CVSS 4.0 base score of 6.4 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

| CVE-2026-72881 MEDIUM

OS Command Injection (CWE-78)

2026-08-10 GitHub_M

PostgreSQL Command Injection Dokploy

6.4

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.4 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Network vector via web management interface; PR:H because database configuration access requires administrator role; scope changes to database containers where full C/I/A impact occurs.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 10, 2026 - 21:05 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 20:01 vuln.today

Analysis Generated

Aug 10, 2026 - 20:01 vuln.today

DescriptionCVE.org

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, database backup and restore command builders in packages/server/src/utils/backups/utils.ts and packages/server/src/utils/restore/utils.ts interpolate database names, usernames, and passwords into nested shell command strings passed to child_process.exec(). An authenticated administrator with permission to create databases and configure backups can use crafted database configuration fields to execute arbitrary commands inside PostgreSQL, MariaDB, MySQL, MongoDB, or LibSQL containers, exposing database data and credentials and potentially enabling escape when a container is overprivileged. This issue is fixed in version 0.29.13.

AnalysisAI

Command injection in Dokploy's database backup and restore utilities (prior to v0.29.13) lets an authenticated administrator execute arbitrary shell commands inside managed database containers by supplying crafted values in database name, username, or password configuration fields. All supported database types are affected - PostgreSQL, MariaDB, MySQL, MongoDB, and LibSQL - with subsequent-system impact rated High across confidentiality, integrity, and availability, reflecting that injected commands run inside the database containers rather than Dokploy itself. No confirmed active exploitation (not in CISA KEV), but the public fix PR includes functional injection payload examples that effectively demonstrate the technique, and the vendor has confirmed the issue via GitHub Security Advisory GHSA-qc73-mp78-4833.

Technical ContextAI

Dokploy is a Node.js-based self-hostable PaaS that manages containerized databases via Docker. The vulnerable code in packages/server/src/utils/backups/utils.ts and packages/server/src/utils/restore/utils.ts constructs Docker exec command strings using JavaScript template literals that directly interpolate attacker-controlled values - database name, username, and password - into double-quoted shell command strings, e.g., docker exec -i $CONTAINER_ID bash -c "...pg_dump ... -U ${databaseUser} ... '${database}'". These concatenated strings are then passed to Node.js child_process.exec(), which hands the full string to /bin/sh for parsing. Standard shell metacharacters ($(), backticks, ;, unescaped quotes) inside the interpolated values break the intended quoting boundaries, achieving OS Command Injection (CWE-78). The affected CPE is cpe:2.3:a:dokploy:dokploy:*:*:*:*:*:*:*:*. The fix (commit ccd2e83c) introduces the shell-quote library to escape values for the outer shell and routes all user-controlled data through Docker environment variables (-e VAR=value) referenced as $VAR inside single-quoted inner shell scripts, eliminating the injection surface entirely.

RemediationAI

Upgrade Dokploy to version 0.29.13 or later - this is the vendor-confirmed patched release available at https://github.com/Dokploy/dokploy/releases/tag/v0.29.13 (fix commit ccd2e83c57d99f725220d37e0152270e0827d71b, PR #4862). If immediate upgrade is not feasible, audit all existing database configurations for anomalous values in name, username, or password fields - particularly entries containing shell metacharacters such as $, ` `, ;`, or unbalanced quotes. Restrict the Dokploy administrator role with database management permissions to the minimum number of trusted accounts; reducing the number of principals who can set database configuration fields directly shrinks the exploitable attack surface. Restricting network access to the Dokploy management interface provides defense-in-depth but does not address the injection root cause, since exploitation requires authenticated access in all cases. For deployments where container escape is a concern, ensure database containers do not run with elevated Docker capabilities or sensitive host volume mounts, limiting post-exploitation blast radius.