CVE-2026-72880: Dokploy Path Traversal Vulnerability

CVE-2026-72880 Overview

CVE-2026-72880 affects Dokploy, a free self-hostable Platform as a Service (PaaS). The flaw resides in the apiCreateCertificate schema in packages/server/src/db/schema/certificate.ts, which accepts a client-supplied certificatePath. The service layer in packages/server/src/services/certificate.ts joins that value to the certificate root directory without confinement checks. An authenticated user with certificate create or delete permission can supply a crafted certificatePath to write attacker-controlled content outside the intended directory or delete arbitrary directories. The issue is classified under [CWE-78] (OS Command Injection) and fixed in Dokploy 0.29.13.

Critical Impact
An authenticated attacker with certificate permissions can write files to or delete directories outside the intended root, leading to arbitrary file write, data destruction, and potential command execution on the Dokploy host.

Affected Products

Dokploy versions prior to 0.29.13
packages/server/src/services/certificate.ts service module
packages/server/src/db/schema/certificate.ts schema module

Discovery Timeline

2026-08-10 - CVE-2026-72880 published to NVD
2026-08-11 - Last updated in NVD database
Dokploy 0.29.13 - Patch released via GitHub Release v0.29.13

Technical Details for CVE-2026-72880

Vulnerability Analysis

The vulnerability stems from unsafe path handling in Dokploy's certificate management pipeline. The apiCreateCertificate schema accepts a certificatePath parameter directly from client input. Downstream, certificate.ts concatenates the supplied path with the certificate root directory using standard join semantics. Because no normalization or boundary check confines the resulting path, traversal sequences such as ../ escape the intended root.

Authenticated users with certificate create or delete privileges can then write attacker-controlled certificate content to arbitrary filesystem locations. The same primitive enables deletion of directories outside the certificate root. On a PaaS host running orchestration services, this primitive extends to overwriting configuration files, docker-compose descriptors, or systemd units. The patch also introduces shell-quote escaping in certificate.ts and mount.ts, indicating that path values also reached shell command invocations, which broadens the impact to command injection.

Root Cause

The root cause is missing input validation on the certificatePath field. Server code trusts client-supplied path components and applies path joining without verifying that the resolved path stays within the certificate root. Shell invocations further consume these paths without argument quoting.

Attack Vector

An authenticated user issues a certificate create or delete request through the Dokploy API with a certificatePath containing traversal segments. The server resolves the path outside the intended root and performs the write or delete. Because the same values feed shell commands, attacker-influenced strings can also break out of argument context and execute additional commands.

typescript

// Patch excerpt: packages/server/src/services/certificate.ts
 import { removeDirectoryIfExistsContent } from "@dokploy/server/utils/filesystem/directory";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import { quote } from "shell-quote";
 import { stringify } from "yaml";
 import type { z } from "zod";
 import { encodeBase64 } from "../utils/docker/utils";

typescript

// Patch excerpt: packages/server/src/services/mount.ts
 } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, type SQL, sql } from "drizzle-orm";
+import { quote } from "shell-quote";
 import type { z } from "zod";

Source: GitHub Commit 16b5b72. The shell-quote import is used to escape file paths before they are interpolated into shell invocations.

Detection Methods for CVE-2026-72880

Indicators of Compromise

Certificate API requests containing ../, ..\, URL-encoded traversal sequences, or absolute paths in the certificatePath field.
Files with .crt, .key, or .pem extensions appearing outside the Dokploy certificate root directory.
Unexpected deletion of directories on the Dokploy host owned by the service account running Dokploy.
Shell metacharacters (;, |, `, $() appearing in certificate-related audit records.

Detection Strategies

Inspect Dokploy application logs for apiCreateCertificate calls where the submitted path resolves outside the configured certificate root.
Correlate certificate CRUD activity with filesystem change events on the Dokploy host to identify writes outside expected directories.
Alert on authenticated user accounts issuing certificate operations at abnormal volume or with unusual path patterns.

Monitoring Recommendations

Enable filesystem auditing on the Dokploy host for write and unlink operations outside the certificate directory.
Forward Dokploy API access logs to a central log store and retain the raw certificatePath parameter for review.
Monitor process execution for shell commands spawned by the Dokploy service that reference user-controlled path fragments.

How to Mitigate CVE-2026-72880

Immediate Actions Required

Upgrade Dokploy to version 0.29.13 or later without delay.
Audit all accounts that hold certificate create or delete permissions and revoke access that is not required.
Review the certificate root directory and the wider filesystem for files or deletions that indicate prior exploitation.
Rotate any credentials, tokens, or private keys stored on the Dokploy host if unauthorized file write is suspected.

Patch Information

The fix is available in Dokploy 0.29.13. Details are published in GitHub Security Advisory GHSA-q9qw-ch66-5hw3 and merged through Pull Request #4873. The patch confines certificate paths to the intended root and applies shell-quote escaping for values that reach shell invocations. The corresponding release is Dokploy v0.29.13.

Workarounds

Restrict certificate create and delete permissions to a minimal set of trusted administrators until the upgrade is applied.
Place the Dokploy API behind an authenticated reverse proxy that inspects and blocks certificatePath values containing traversal sequences or absolute paths.
Run Dokploy under a dedicated low-privilege service account with a filesystem confined by mandatory access controls (AppArmor, SELinux) to limit blast radius.

bash

# Upgrade Dokploy to the patched release
docker pull dokploy/dokploy:0.29.13
docker stop dokploy && docker rm dokploy

# Redeploy using the pinned patched version per official install docs
# Verify the running version after upgrade
curl -s http://localhost:3000/api/health | jq '.version'