None severity · published Aug 10, 2026
CVE-2026-72885
Dokploy: Authenticated Command Injection in Dokploy Dockerfile Builder
0.0
CVSS
0.8%
EPSS
No
On KEV
Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, dockerContextPath accepted by apps/dokploy/components/dashboard/application/build/show.tsx flows through getDockerContextPath in packages/server/src/utils/filesystem/directory.ts into the unquoted cd command in packages/server/src/utils/builders/docker-file.ts before execution by execAsync, allowing an authenticated application editor to execute arbitrary commands on the Dokploy host. This issue is fixed in version 0.29.13.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
dokploy · Dokploy
< 0.29.13 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-72885
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-72885
github.com
https://github.com/Dokploy/dokploy/commit/cba0b253c7de4157dd932de7f16a2ad247c7cee9
github.com
https://github.com/Dokploy/dokploy/pull/4860
github.com
https://github.com/Dokploy/dokploy/releases/tag/v0.29.13
github.com
https://github.com/Dokploy/dokploy/security/advisories/GHSA-qjrc-g63x-qhp9
More from dokploy
10.0
CVE-2026-45631
Dokploy: Pre-Auth Admin Takeover via Hardcoded Authentication Secret
9.9
CVE-2026-93425
Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root
9.9
CVE-2026-82954
Dokploy Settings application.ts writeTraefikConfigInPath path traversal
9.9
CVE-2026-72902
Dokploy: Authenticated RCE via Command Injection in registry.testRegistry / registry.testRegistryById
9.9
CVE-2026-72901
Dokploy: Remote Code Execution via volume-backup