CVE-2026-72738: Dokploy Platform Command Injection RCE Flaw

CVE-2026-72738 Overview

CVE-2026-72738 is a command injection vulnerability in Dokploy, a self-hostable Platform as a Service (PaaS). The flaw resides in the backup.listBackupFiles tRPC endpoint defined in apps/dokploy/server/api/routers/backup.ts. The endpoint passes the search parameter through normalizeS3Path and interpolates it into an rclone lsjson command executed by child_process.exec(). An authenticated user holding the backup:read permission can inject shell metacharacters into search to execute arbitrary commands on the Dokploy host. The issue is fixed in version 0.29.13 and tracked under [CWE-78].

Critical Impact
Authenticated attackers with backup:read permission can achieve arbitrary command execution on the Dokploy host, leading to full compromise of hosted applications and infrastructure.

Affected Products

Dokploy versions prior to 0.29.13
Dokploy self-hosted PaaS deployments exposing the tRPC backup router
Dokploy instances where any account has backup:read permission

Discovery Timeline

2026-08-10 - CVE-2026-72738 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72738

Vulnerability Analysis

Dokploy exposes backup management through tRPC routers. The listBackupFiles procedure accepts a search parameter used to filter S3 objects via rclone. Instead of passing arguments to rclone through an argv array, the router builds a shell command string containing the user-supplied search value and executes it with child_process.exec(). Because exec() spawns /bin/sh -c, any shell metacharacter in search is interpreted by the shell.

The normalizeS3Path helper only normalizes path syntax. It does not sanitize characters such as ;, |, `, $(), or newlines. A permitted user can send a crafted search string that breaks out of the intended rclone lsjson invocation and runs attacker-controlled commands as the Dokploy process user.

Root Cause

The root cause is unsafe command construction combined with reliance on a normalization routine that is not a security boundary. String interpolation of untrusted input into a shell command executed by child_process.exec() violates the principle of separating code from data. The backup:read role was assumed to be low risk, so input validation was minimal. In practice, that role grants a path to full remote code execution.

Attack Vector

The attack is network-reachable and requires only a low-privilege authenticated session with backup:read. The attacker invokes the backup.listBackupFiles tRPC endpoint with a search payload containing shell metacharacters. Because the scope changes to the underlying host, the confidentiality, integrity, and availability of hosted projects, secrets, and the Docker socket are all at risk.

typescript

// Patch excerpt: apps/dokploy/server/api/routers/backup.ts
// Source: https://github.com/Dokploy/dokploy/commit/eeb6e7b8ea88e4b4b1fac8460755464100516ac9
 	restoreWebServerBackup,
 } from "@dokploy/server/utils/restore";
 import { TRPCError } from "@trpc/server";
+import { quote } from "shell-quote";
 import { z } from "zod";
 import {
 	createTRPCRouter,

typescript

// Patch excerpt: apps/dokploy/server/api/routers/destination.ts
// Source: https://github.com/Dokploy/dokploy/commit/eeb6e7b8ea88e4b4b1fac8460755464100516ac9
 import { db } from "@dokploy/server/db";
 import { TRPCError } from "@trpc/server";
 import { desc, eq } from "drizzle-orm";
+import { quote } from "shell-quote";
 import { createTRPCRouter, withPermission } from "@/server/api/trpc";
 import { audit } from "@/server/api/utils/audit";
 import {

The fix introduces shell-quote's quote() to escape S3 and rclone arguments before they reach the shell, closing the injection path. See the GitHub Security Advisory GHSA-5vjv-73wr-rf79 for the full write-up.

Detection Methods for CVE-2026-72738

Indicators of Compromise

Unexpected child processes of the Dokploy Node.js process, especially shells (sh, bash) spawning binaries other than rclone.
rclone lsjson invocations whose argument list contains shell metacharacters such as ;, |, &&, backticks, or $(...).
Outbound network connections from the Dokploy host to unfamiliar hosts shortly after backup.listBackupFiles tRPC calls.
New or modified files under Dokploy working directories, SSH authorized_keys, or cron entries created by the Dokploy service user.

Detection Strategies

Inspect Dokploy application logs for tRPC calls to backup.listBackupFiles with unusual search values, particularly those containing non-path characters.
Correlate process-creation telemetry on the Dokploy host with the parent node process and flag any non-rclone descendants.
Alert on execution of reconnaissance tools (id, whoami, curl, wget, nc) as children of the Dokploy service.

Monitoring Recommendations

Enable audit logging for authenticated actions in Dokploy and forward logs to a centralized SIEM for retention and correlation.
Track membership of any role that grants the backup:read permission and alert on new assignments.
Monitor egress traffic from the Dokploy host and baseline expected destinations for backup operations.

How to Mitigate CVE-2026-72738

Immediate Actions Required

Upgrade Dokploy to version 0.29.13 or later without delay, following the GitHub Release v0.29.13 notes.
Audit all user accounts and roles for the backup:read permission and revoke access that is not required.
Rotate credentials, API tokens, and S3 keys stored on the Dokploy host, because the process user may have had access to them.
Review the Dokploy host for signs of post-exploitation activity such as new users, SSH keys, or scheduled tasks.

Patch Information

The fix is delivered in Dokploy 0.29.13. The maintainers introduced shell-quote's quote() in apps/dokploy/server/api/routers/backup.ts and apps/dokploy/server/api/routers/destination.ts to escape rclone and S3 arguments before shell execution. Full details are available in the GitHub Commit Update and the GitHub Security Advisory GHSA-5vjv-73wr-rf79.

Workarounds

Restrict network access to the Dokploy web UI and tRPC endpoints to trusted administrative networks or a VPN.
Remove the backup:read permission from all non-administrative roles until the patch is applied.
Run Dokploy as a low-privilege service user isolated from other workloads to limit blast radius if the host is compromised.

bash

# Configuration example: verify the installed Dokploy version and upgrade
docker inspect dokploy --format '{{.Config.Image}}'
docker pull dokploy/dokploy:0.29.13
docker stop dokploy && docker rm dokploy
# Re-deploy using your existing compose or install command pinned to 0.29.13