CVE-2026-72875: Dokploy Platform Command Injection RCE

CVE-2026-72875 Overview

CVE-2026-72875 is a command injection vulnerability in Dokploy, a free, self-hostable Platform as a Service (PaaS). Versions prior to 0.29.13 pass a user-supplied file path through settings.readTraefikFile in apps/dokploy/server/api/routers/settings.ts to readConfigInPath in packages/server/src/utils/traefik/application.ts. The configPath argument is interpolated directly into execAsyncRemote as cat ${configPath}, allowing shell metacharacter injection. Any authenticated user holding the traefikFiles.read permission can execute arbitrary commands on a managed server. The issue is tracked as [CWE-78] (OS Command Injection) and is fixed in version 0.29.13.

Critical Impact
Authenticated attackers with traefikFiles.read permission can execute arbitrary shell commands on managed Dokploy servers, leading to full host compromise.

Affected Products

Dokploy versions prior to 0.29.13
Self-hosted Dokploy PaaS deployments
Managed servers connected via Dokploy's remote execution channel

Discovery Timeline

2026-08-10 - CVE-2026-72875 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72875

Vulnerability Analysis

The vulnerability lives in Dokploy's Traefik configuration reader. The API router settings.readTraefikFile accepts a path validated by apiReadTraefikConfig and forwards it to readConfigInPath. That helper builds a shell command by string interpolation: cat ${configPath}. The result is passed to execAsyncRemote, which runs the command over SSH on the target managed server.

Because the path is embedded without escaping or argument separation, shell metacharacters such as ;, |, `, $(...), and && break out of the cat invocation. An attacker with traefikFiles.read permission crafts a value like /etc/traefik/traefik.yml; id > /tmp/pwn to execute arbitrary commands under the account Dokploy uses on the remote host.

The attack reaches through authenticated network access and requires no user interaction. Successful exploitation grants command execution on every server the Dokploy instance manages, not only the controller.

Root Cause

The root cause is unsafe shell interpolation of a caller-controlled string. The path validator accepts values that are legal file paths but still contain shell-active characters. There is no argument quoting, no execFile-style separation between program and argument, and no allowlist of expected paths under the Traefik configuration directory.

Attack Vector

An authenticated Dokploy user with the traefikFiles.read permission calls the settings.readTraefikFile endpoint and supplies a path value containing shell metacharacters. The server interpolates the value into cat ${configPath} and executes it remotely, running attacker-controlled commands on the managed host.

typescript

// Patch excerpt: packages/server/src/utils/traefik/application.ts
 import { createInterface } from "node:readline";
 import { paths } from "@dokploy/server/constants";
 import type { Domain } from "@dokploy/server/services/domain";
+import { quote } from "shell-quote";
 import { parse, stringify } from "yaml";
 import { encodeBase64 } from "../docker/utils";
 import { execAsync, execAsyncRemote } from "../process/execAsync";

Source: GitHub commit 92310dd. The patch imports shell-quote to escape config paths and base64-encodes remote Traefik YAML rather than interpolating user input into shell commands.

Detection Methods for CVE-2026-72875

Indicators of Compromise

Unexpected child processes of the Dokploy service or its SSH sessions on managed servers, particularly shells spawned from cat invocations.
Log entries for settings.readTraefikFile calls containing shell metacharacters (;, |, `, $, &) in the path parameter.
Outbound network connections from managed servers to unknown hosts shortly after Traefik configuration reads.
New files, cron entries, or SSH keys created under the Dokploy runtime user on managed hosts.

Detection Strategies

Inspect Dokploy API access logs for readTraefikFile requests where the path field deviates from the expected traefik/**/*.yml pattern.
Correlate execAsyncRemote command executions with the identity of the calling Dokploy user and the requested Traefik path.
Alert on process ancestry showing sh -c "cat ..." producing non-file-read child processes such as curl, wget, bash, python, or nc.

Monitoring Recommendations

Enable audit logging (auditd on Linux) for execve calls on managed servers and forward events to a central log store.
Monitor the Dokploy control-plane host for outbound SSH sessions issuing commands other than the documented management set.
Track role and permission changes that grant traefikFiles.read to accounts that do not require it.

How to Mitigate CVE-2026-72875

Immediate Actions Required

Upgrade Dokploy to version 0.29.13 or later on every controller instance.
Audit accounts holding the traefikFiles.read permission and revoke it from users who do not need Traefik configuration access.
Rotate SSH keys, API tokens, and secrets used by Dokploy to reach managed servers if exploitation is suspected.
Review command execution history on managed servers for the period prior to patching.

Patch Information

The fix ships in Dokploy release v0.29.13. It is delivered via pull request #4873 and commit 92310dd. The patch escapes configuration paths using shell-quote and base64-encodes remote Traefik YAML content before shell handling. Additional context is available in the GHSA-j3pv-r5wg-235m advisory.

Workarounds

Remove the traefikFiles.read permission from all non-administrative roles until upgrade is complete.
Restrict network access to the Dokploy API to trusted operators via firewall rules or a VPN.
Place a reverse proxy in front of Dokploy that rejects path parameters containing shell metacharacters.

bash

# Upgrade Dokploy to the patched version
docker pull dokploy/dokploy:0.29.13
docker service update --image dokploy/dokploy:0.29.13 dokploy

# Verify the running version
docker service inspect dokploy \
  --format '{{.Spec.TaskTemplate.ContainerSpec.Image}}'