CVE-2026-72865: Dokploy Command Injection RCE Vulnerability

CVE-2026-72865 Overview

CVE-2026-72865 is a command injection vulnerability in Dokploy, a self-hostable Platform as a Service (PaaS). Versions prior to 0.29.13 store an unvalidated composePath value that is later interpolated into shell commands executed by the Dokploy server. The affected code paths reside in packages/server/src/utils/builders/compose.ts and packages/server/src/services/compose.ts, which pass the value directly to docker compose -f, docker stack deploy -c, and touch commands invoked through /bin/sh -c. An authenticated user with compose write and deploy permissions can supply a crafted composePath and execute arbitrary operating-system commands on the Dokploy host [CWE-78].

Critical Impact
Authenticated attackers with compose deploy permissions can execute arbitrary commands in the Docker-privileged Dokploy host context, resulting in full host compromise.

Affected Products

Dokploy versions prior to 0.29.13
Dokploy compose.update operation
Dokploy server components handling Docker Compose and Docker Swarm deployments

Discovery Timeline

2026-08-10 - CVE-2026-72865 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72865

Vulnerability Analysis

Dokploy exposes a compose.update operation that persists a user-supplied composePath attribute for compose applications. When compose.deploy or startCompose is later triggered, the stored value is interpolated unescaped into shell command strings executed via /bin/sh -c. Because Dokploy runs with Docker-privileged access on the host, command injection at this layer results in arbitrary code execution with the privileges of the Dokploy runtime.

The vulnerable command constructions include docker compose -f <composePath>, docker stack deploy -c <composePath>, and touch <composePath>. Any shell metacharacter such as ;, &, |, backticks, or $(...) embedded in the path breaks out of the intended argument and is executed as a separate shell command.

Root Cause

The root cause is missing input sanitization and unsafe string interpolation into shell command lines. The composePath field was trusted as a filesystem path without validating that it contained no shell control characters, and command strings were assembled through template literals rather than argument arrays passed to a non-shell executor.

Attack Vector

Exploitation requires an authenticated Dokploy account with compose write and deploy permission. The attacker calls compose.update with a crafted composePath containing shell metacharacters, then invokes compose.deploy or startCompose to trigger execution. The injected command runs on the Dokploy host in a Docker-privileged context, permitting container escape, credential theft, and lateral movement.

typescript

// Patch: packages/server/src/utils/builders/compose.ts
// fix(security): escape compose path and validate custom compose command

// Shell control characters that must never appear in a user-provided compose
// command: they would let it break out of the `docker ${command}` invocation
// into arbitrary host commands. A normal docker compose CLI line never needs them.
const UNSAFE_COMPOSE_COMMAND = /[;&|`$(){}<>\n\\]/;

const sanitizeCommand = (command: string) => {
    const sanitizedCommand = command.trim();

    if (UNSAFE_COMPOSE_COMMAND.test(sanitizedCommand)) {
        throw new Error(
            "Invalid characters in compose command: shell control characters are not allowed",
        );
    }

    const parts = sanitizedCommand.split(/\s+/);
    const restCommand = parts.map((arg) => arg.replace(/^"(.*)"$/, "$1"));
};

Source: GitHub Commit d48037a

The patch introduces a deny-list of shell control characters and adopts the shell-quote library in packages/server/src/services/compose.ts to properly quote path arguments before they reach /bin/sh -c.

Detection Methods for CVE-2026-72865

Indicators of Compromise

Unexpected child processes of the Dokploy server process, particularly /bin/sh -c invocations containing non-path characters such as ;, |, &, backticks, or $(...).
compose.update API calls where the composePath field contains shell metacharacters or newline characters.
Outbound network connections from the Dokploy host to unfamiliar destinations shortly after a compose.deploy or startCompose action.
New user accounts, SSH keys, or cron entries created on the Dokploy host without a corresponding administrative change.

Detection Strategies

Audit Dokploy application logs for compose.update operations and inspect the stored composePath values for anomalous content.
Monitor process telemetry on the Dokploy host for shell invocations spawned by the Node.js runtime with argument strings that deviate from expected docker compose or docker stack deploy patterns.
Correlate authenticated Dokploy user actions with subsequent host-level command execution to identify abuse of legitimate compose permissions.

Monitoring Recommendations

Enable verbose audit logging on the Dokploy host and forward process, file, and network events to a centralized analytics platform.
Alert on any touch, docker compose, or docker stack deploy command whose arguments contain shell control characters.
Track the population of users granted compose write and deploy permission and review that membership regularly.

How to Mitigate CVE-2026-72865

Immediate Actions Required

Upgrade Dokploy to version 0.29.13 or later on every self-hosted instance.
Restrict compose write and deploy permissions to a minimal set of trusted operators until the upgrade is complete.
Review existing compose applications for composePath values containing shell metacharacters and remove or correct any suspicious entries.
Rotate credentials, API tokens, and SSH keys stored on any Dokploy host suspected of compromise.

Patch Information

The fix is delivered in Dokploy release v0.29.13 via Pull Request #4863 and commit d48037a. The patch adds a UNSAFE_COMPOSE_COMMAND deny-list regex and uses shell-quote to escape path arguments before they are passed to /bin/sh -c. Full details are available in the GitHub Security Advisory GHSA-8r5w-vqjr-8c44.

Workarounds

Temporarily revoke compose deploy permissions from all non-administrative accounts until version 0.29.13 is installed.
Place the Dokploy management interface behind a VPN or IP allow-list to reduce the exposed attack surface.
Run Dokploy on a dedicated host with no additional sensitive workloads to limit blast radius should command injection succeed.

bash

# Upgrade Dokploy to the patched release
curl -sSL https://dokploy.com/install.sh | sh

# Or pin the container image to the fixed version
docker pull dokploy/dokploy:v0.29.13
docker service update --image dokploy/dokploy:v0.29.13 dokploy