CVE-2026-72878: Dokploy Command Injection RCE Vulnerability

CVE-2026-72878 Overview

CVE-2026-72878 is a command injection vulnerability [CWE-78] in Dokploy, a free, self-hostable Platform as a Service (PaaS). Versions prior to 0.29.13 construct shell commands by directly interpolating user-controlled database fields into bash -c "..." and sh -c "..." strings, then execute them via child_process.exec(). An authenticated admin or owner can inject arbitrary operating system commands that run on the host machine, escaping the container boundary. The vulnerability is fixed in Dokploy version 0.29.13.

Critical Impact
Authenticated admin or owner users can execute arbitrary OS commands on the Dokploy host, gaining full control over the PaaS infrastructure and any hosted workloads.

Affected Products

Dokploy versions prior to 0.29.13
Dokploy backup pipeline (apps/dokploy/server/api/routers/backup.ts)
Dokploy destination pipeline (apps/dokploy/server/api/routers/destination.ts)

Discovery Timeline

2026-08-10 - CVE-2026-72878 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-72878

Vulnerability Analysis

Dokploy's backup and restore pipeline builds shell commands through direct string interpolation of database fields controlled by admin and owner users. The resulting strings pass to Node.js child_process.exec() via bash -c and sh -c wrappers. Because the shell parses the full command string, any metacharacter injected into a backup or destination field escapes the intended command context. The vulnerability affects TRPC routers responsible for backup configuration and remote destination storage. Successful exploitation grants command execution on the underlying host, not just inside a container. This exposes the Dokploy control plane, its Docker socket, and every application it manages.

Root Cause

The root cause is missing shell argument quoting on user-controlled inputs before they are concatenated into shell command strings. The fix introduces the shell-quote library's quote function to safely escape arguments in both backup.ts and destination.ts routers.

Attack Vector

An attacker authenticated as an admin or owner supplies malicious content in backup or destination configuration fields. When Dokploy invokes the backup or restore pipeline, the injected shell metacharacters execute on the host operating system with the privileges of the Dokploy service.

typescript

// Security patch in apps/dokploy/server/api/routers/backup.ts
// Source: https://github.com/Dokploy/dokploy/commit/d02f34f9d48b363b9bf15a948e263ff4ebfcceda

 	restoreWebServerBackup,
 } from "@dokploy/server/utils/restore";
 import { TRPCError } from "@trpc/server";
+import { quote } from "shell-quote";
 import { z } from "zod";
 import {
 	createTRPCRouter,

// Security patch in apps/dokploy/server/api/routers/destination.ts
 import { db } from "@dokploy/server/db";
 import { TRPCError } from "@trpc/server";
 import { desc, eq } from "drizzle-orm";
+import { quote } from "shell-quote";
 import { createTRPCRouter, withPermission } from "@/server/api/trpc";
 import { audit } from "@/server/api/utils/audit";

Detection Methods for CVE-2026-72878

Indicators of Compromise

Unexpected child processes spawned by the Dokploy Node.js process, particularly bash -c or sh -c invocations containing unusual metacharacters such as ;, &&, |, or backticks.
Outbound network connections from the Dokploy host to unfamiliar destinations shortly after backup or restore operations.
New or modified files under /tmp, /var/tmp, or the Dokploy working directory following backup configuration changes.

Detection Strategies

Audit Dokploy admin and owner activity for edits to backup schedules, destination credentials, and database identifiers.
Monitor process telemetry for child_process.exec chains that spawn shells with arguments derived from application input.
Correlate TRPC API calls to backup.* and destination.* routes with subsequent host-level command execution.

Monitoring Recommendations

Enable command-line logging on the Dokploy host and forward events to a centralized log store for review.
Alert on any shell process launched by the Dokploy service account outside expected backup schedules.
Track version metadata to confirm all Dokploy instances run 0.29.13 or later.

How to Mitigate CVE-2026-72878

Immediate Actions Required

Upgrade Dokploy to version 0.29.13 or later, which introduces shell-quote based argument escaping.
Rotate any credentials, API tokens, or SSH keys stored on Dokploy hosts that may have been exposed to admin users.
Review admin and owner account membership and remove unnecessary privileged accounts.

Patch Information

The fix is delivered in Dokploy Release v0.29.13 via Pull Request #4873 and commit d02f34f. See the GitHub Security Advisory GHSA-p2c7-8j28-c7gq for full advisory details.

Workarounds

Restrict admin and owner role assignments to a minimal set of trusted operators until the upgrade is applied.
Place the Dokploy management interface behind a VPN or IP allowlist to limit exposure of the authenticated attack surface.
Disable backup and destination configuration changes for non-essential users where role separation permits.

bash

# Upgrade Dokploy to the patched release
curl -sSL https://dokploy.com/install.sh | sh

# Verify the running version is 0.29.13 or later
docker exec dokploy sh -c 'cat package.json | grep "\"version\""'