CVE-2026-72874: Dokploy Platform RCE Vulnerability

CVE-2026-72874 Overview

Dokploy is a free, self-hostable Platform as a Service (PaaS) used to deploy and manage applications. CVE-2026-72874 is an OS command injection vulnerability [CWE-78] affecting Dokploy versions prior to 0.29.13. The cloneGitRepository function in packages/server/src/utils/providers/git.ts interpolates the customGitUrl and customGitBranch values directly into a git clone command executed via execAsync or execAsyncRemote. An authenticated user with application access can configure a malicious custom Git URL and trigger a deployment to execute arbitrary operating system commands on the Dokploy host. The issue is fixed in version 0.29.13.

Critical Impact
Authenticated attackers with application access can execute arbitrary commands on the Dokploy host, leading to full compromise of the PaaS environment and any tenant applications it manages.

Affected Products

Dokploy versions prior to 0.29.13
Self-hosted Dokploy PaaS deployments
Any Dokploy tenant applications using custom Git provider configurations

Discovery Timeline

2026-08-10 - CVE-2026-72874 published to NVD
2026-08-11 - Last updated in NVD database
v0.29.13 - Dokploy releases patched version with input escaping across all Git providers

Technical Details for CVE-2026-72874

Vulnerability Analysis

The vulnerability resides in the Git provider handling code within Dokploy's server package. When a user configures an application with a custom Git repository, Dokploy invokes cloneGitRepository to fetch source code prior to build and deployment. The function builds a git clone shell command by concatenating user-controlled inputs, customGitUrl and customGitBranch, into the command string without shell escaping. The composed command is then executed through execAsync (locally) or execAsyncRemote (on a remote worker) which invokes a shell interpreter. Any shell metacharacters embedded in the user input are evaluated by the shell, producing command injection under the identity of the Dokploy runtime.

Root Cause

The root cause is unsafe construction of an OS command from untrusted input, classified as Improper Neutralization of Special Elements used in an OS Command [CWE-78]. The pre-patch code did not apply a shell-escaping helper to Git provider parameters. The patch introduces a shellWord utility imported from ./utils and applies it consistently across Git provider modules including git.ts and bitbucket.ts to quote user-supplied values before they are appended to the git clone invocation.

Attack Vector

Exploitation requires an authenticated Dokploy account with permission to create or modify an application. The attacker sets the custom Git URL field to a value containing shell metacharacters, such as command separators or command substitution syntax, and triggers a deployment. When Dokploy runs the interpolated git clone command, the injected payload executes on the host or remote worker running the deployment.

typescript

// Patch excerpt: packages/server/src/utils/providers/git.ts
// Source: https://github.com/Dokploy/dokploy/commit/47347ab885b0ad1f5d0ef0e5e74bbba35c7f93bc
 	updateSSHKeyById,
 } from "@dokploy/server/services/ssh-key";
 import { execAsync, execAsyncRemote } from "../process/execAsync";
+import { shellWord } from "./utils";
 
 interface CloneGitRepository {
 	appName: string;

The corresponding change in packages/server/src/utils/providers/bitbucket.ts applies the same shellWord escaping helper across all Git providers, indicating the flaw was systemic to how Dokploy passed user input to git shell commands.

Detection Methods for CVE-2026-72874

Indicators of Compromise

Unexpected child processes spawned by the Dokploy server or deployment worker under a git clone parent process.
Outbound network connections from the Dokploy host to unfamiliar hosts initiated during or immediately after a deployment.
Application records containing customGitUrl or customGitBranch values with shell metacharacters such as backticks, $( ), ;, &&, or |.
New or modified SSH keys, cron entries, or systemd units on the Dokploy host correlated with deployment events.

Detection Strategies

Audit the Dokploy application database for Git provider fields containing shell metacharacters or non-URL syntax.
Correlate deployment audit events with process execution telemetry to identify shells spawned from git invocations.
Alert on any process launched by the Dokploy service that is not part of the expected build toolchain, such as bash, sh, curl, or wget executed directly by the deployment worker.

Monitoring Recommendations

Enable command-line and process-lineage logging on Dokploy hosts and forward events to a centralized analytics platform.
Monitor authenticated Dokploy user activity for suspicious repeated edits to Git URL fields followed by deployment triggers.
Track egress traffic from Dokploy worker nodes and flag connections to hosts outside the expected registry, Git, and package repository ranges.

How to Mitigate CVE-2026-72874

Immediate Actions Required

Upgrade all Dokploy installations to version 0.29.13 or later without delay.
Review all existing applications for suspicious customGitUrl or customGitBranch values and remove or sanitize them.
Rotate credentials, SSH keys, and API tokens stored on the Dokploy host if a prior compromise is suspected.
Restrict Dokploy application-creation privileges to trusted operators until the upgrade is completed.

Patch Information

The fix is delivered in Dokploy v0.29.13. The remediation introduces a shellWord escaping helper and applies it to user-controlled Git parameters across all Git provider modules. See the GitHub commit, the pull request, and the GitHub Security Advisory GHSA-hrfh-82jj-3q46 for technical details.

Workarounds

If immediate upgrade is not possible, disable the ability for non-administrative users to create or edit applications with custom Git URLs.
Place the Dokploy server behind network controls that restrict outbound connectivity to only required Git, registry, and package endpoints.
Run Dokploy workers under a least-privilege service account and in isolated containers to limit blast radius from any injected command.

bash

# Upgrade Dokploy to the patched release
docker pull dokploy/dokploy:0.29.13
docker compose -f /etc/dokploy/docker-compose.yml up -d

# Verify the running version
docker exec -it dokploy sh -c 'cat package.json | grep version'