CVE-2026-72739: Dokploy Platform RCE Vulnerability

CVE-2026-72739 Overview

Dokploy is a free, self-hostable Platform as a Service (PaaS) used to deploy containerized applications. CVE-2026-72739 is an OS command injection vulnerability [CWE-78] in the createCommand() function of Dokploy versions prior to 0.29.13. The function builds shell commands by interpolating Docker Compose service names and configuration values directly into bash command strings. An authenticated attacker who deploys a compose file with a maliciously crafted name or service definition can inject shell metacharacters that are interpreted as command separators. This results in arbitrary command execution on the Docker host running Dokploy. The vulnerability is fixed in version 0.29.13.

Critical Impact
Authenticated attackers can execute arbitrary shell commands on the Docker host by supplying compose configurations containing shell metacharacters.

Affected Products

Dokploy versions prior to 0.29.13
Self-hosted Dokploy PaaS deployments
Docker hosts running vulnerable Dokploy instances

Discovery Timeline

2026-08-10 - CVE-2026-72739 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72739

Vulnerability Analysis

The flaw resides in Dokploy's compose deployment path, specifically in the createCommand() function within packages/server/src/utils/builders/compose.ts. The function constructs bash command strings by interpolating user-controllable compose service names and configuration fields without proper shell escaping. Docker Compose file names and custom compose command values pass through the string interpolation and reach a shell interpreter. Any shell metacharacter such as ;, &, |, backtick, $(), or {} breaks out of the intended docker invocation. The attacker gains code execution in the context of the Dokploy server process on the Docker host.

Root Cause

The root cause is missing input sanitization and lack of shell argument escaping when building shell commands from user-supplied compose metadata. The vulnerable code path treated compose names and custom commands as trusted strings and passed them directly into a bash execution context. Because Dokploy allows authenticated users to define compose service names and custom compose commands, low-privilege operators can influence the exact byte sequence executed by the host shell.

Attack Vector

Exploitation requires network access to the Dokploy management interface and low-privilege authenticated access sufficient to create or modify a compose deployment. The attacker crafts a compose configuration whose service name or custom compose command contains shell control characters, then triggers a deployment. When createCommand() builds the deployment command, the injected metacharacters terminate the intended docker compose invocation and append attacker-controlled commands that run on the Docker host.

typescript

// Security patch in packages/server/src/utils/builders/compose.ts
// fix(security): escape compose path and validate custom compose command

	return bashCommand;
};

// Shell control characters that must never appear in a user-provided compose
// command: they would let it break out of the `docker ${command}` invocation
// into arbitrary host commands. A normal docker compose CLI line never needs them.
const UNSAFE_COMPOSE_COMMAND = /[;&|`$(){}<>\n\\]/;

const sanitizeCommand = (command: string) => {
	const sanitizedCommand = command.trim();

	if (UNSAFE_COMPOSE_COMMAND.test(sanitizedCommand)) {
		throw new Error(
			"Invalid characters in compose command: shell control characters are not allowed",
		);
	}

	const parts = sanitizedCommand.split(/\s+/);

	const restCommand = parts.map((arg) => arg.replace(/^"(.*)"$/, "$1"));

Source: GitHub Commit d48037a

The patch introduces the UNSAFE_COMPOSE_COMMAND regex to reject shell control characters and adds the shell-quote library in packages/server/src/services/compose.ts to safely quote compose paths before shell interpolation.

Detection Methods for CVE-2026-72739

Indicators of Compromise

Unexpected child processes spawned by the Dokploy server process, especially shells (bash, sh) with arguments containing compose service names.
Docker host command history containing shell metacharacters such as ;, &&, |, or $() adjacent to docker compose invocations.
Compose files or database entries in Dokploy where service names include non-alphanumeric characters like `, $, or ;.
Outbound network connections from the Dokploy host to unfamiliar destinations shortly after a compose deployment event.

Detection Strategies

Audit Dokploy compose definitions for service names or custom compose commands containing shell metacharacters.
Monitor process creation on Docker hosts for shells launched as children of the Dokploy Node.js process with anomalous argument strings.
Review Dokploy application logs for deployment events immediately preceding unexplained shell activity on the host.

Monitoring Recommendations

Enable command-line auditing on Docker hosts running Dokploy and forward events to a central log store for correlation.
Alert on new persistence artifacts such as cron entries, systemd units, or SSH authorized keys created after compose deployments.
Track outbound connections from Dokploy hosts and flag traffic to non-registry, non-approved destinations.

How to Mitigate CVE-2026-72739

Immediate Actions Required

Upgrade Dokploy to version 0.29.13 or later on all self-hosted instances.
Restrict Dokploy account creation and audit existing accounts with permission to create or modify compose deployments.
Review existing compose deployments and remove entries whose service names or custom commands contain shell metacharacters.
Rotate any secrets, tokens, or SSH keys accessible from the Docker host if unauthorized compose deployments are found.

Patch Information

The fix ships in Dokploy 0.29.13. The patch adds an UNSAFE_COMPOSE_COMMAND regex that rejects the characters ;, &, |, `, $, (, ), {, }, <, >, newline, and backslash in compose commands. It also introduces the shell-quote library to quote compose paths before shell interpolation. See the GitHub Security Advisory GHSA-5xv2-7f8w-9j5c and Dokploy Release v0.29.13.

Workarounds

Limit Dokploy access to trusted operators only until the upgrade is applied.
Place the Dokploy management interface behind a VPN or IP allowlist to reduce network exposure.
Run the Dokploy server under a dedicated low-privilege system account with minimal filesystem and Docker socket access where feasible.

bash

# Configuration example: upgrade Dokploy to the patched release
docker pull dokploy/dokploy:0.29.13
docker service update --image dokploy/dokploy:0.29.13 dokploy

# Verify version after upgrade
docker exec $(docker ps -qf name=dokploy) dokploy --version