CVE-2026-72882: Dokploy Platform RCE Vulnerability

CVE-2026-72882 Overview

CVE-2026-72882 is a command injection vulnerability in Dokploy, a free, self-hostable Platform as a Service (PaaS). Versions 0.28.8 and earlier fail to sanitize the filePath parameter when authenticated users create or update file mounts for a service. Attackers can inject shell metacharacters that Dokploy executes on the configured remote managed server over SSH. In the default deployment model, exploitation yields direct remote code execution on the host from the web interface. The issue is tracked under CWE-78, OS Command Injection.

Critical Impact
An authenticated low-privileged user can achieve remote code execution on the managed host through crafted file mount filePath values.

Affected Products

Dokploy 0.28.8
Dokploy prior versions (all releases ≤ 0.28.8)
Self-hosted PaaS deployments using the default managed-server model

Discovery Timeline

2026-08-10 - CVE-2026-72882 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-72882

Vulnerability Analysis

Dokploy exposes a file mount feature that lets users mount custom files into service containers. The filePath field supplied through the web interface is passed to shell commands executed over SSH on the managed remote server. Because the input is concatenated into a shell context without escaping or allow-listing, characters such as ;, |, &, backticks, and $() are interpreted as shell syntax. An authenticated user who can create or edit a file mount can therefore issue arbitrary commands on the target host.

The vulnerability is reachable over the network and requires only low-privileged authentication with no user interaction. Because the injected command runs in the SSH session that Dokploy uses to manage the target, the attacker inherits the privileges assigned to the Dokploy service account on the remote host, which is typically root or a Docker-capable user.

Root Cause

The root cause is unsanitized concatenation of user-controlled input into an OS command string. Dokploy trusts filePath values submitted through the file mount API and does not enforce a strict allow-list of path characters or use safe argument passing when invoking SSH commands. This maps directly to CWE-78: Improper Neutralization of Special Elements used in an OS Command.

Attack Vector

An authenticated user submits a file mount create or update request containing shell metacharacters in filePath. Dokploy renders that value into a command executed on the managed remote server over SSH. The injected commands run in the shell context of the SSH session, giving the attacker code execution on the managed host. See the GitHub Security Advisory GHSA-qcf5-jjjp-7794 for advisory details.

No verified proof-of-concept code has been published. The vulnerability mechanism is described in prose above; consult the vendor advisory for reproduction details.

Detection Methods for CVE-2026-72882

Indicators of Compromise

File mount records with filePath values containing shell metacharacters such as ;, |, &, $(, or backticks
Unexpected child processes spawned by the Dokploy SSH session on managed servers
New SSH-invoked shell activity coinciding with file mount create or update API calls in Dokploy audit logs
Outbound network connections initiated by the Dokploy service account shortly after file mount changes

Detection Strategies

Review Dokploy application logs for POST and PATCH requests to file mount endpoints and correlate with subsequent process execution on managed hosts.
Alert on shell metacharacters appearing in the filePath field of stored file mount configurations.
Monitor SSH session command history on managed servers for commands not originating from expected Dokploy deployment workflows.

Monitoring Recommendations

Enable authenticated audit logging in Dokploy and forward events to a centralized SIEM.
Baseline the set of commands Dokploy normally executes over SSH and alert on deviations.
Track privilege escalation attempts and unexpected package installations on Dokploy-managed hosts.

How to Mitigate CVE-2026-72882

Immediate Actions Required

Upgrade Dokploy to a version later than 0.28.8 that contains the fix referenced in GHSA-qcf5-jjjp-7794.
Restrict access to the Dokploy web interface to trusted administrators until patching is complete.
Audit existing file mount configurations for shell metacharacters in filePath and remove suspicious entries.
Rotate SSH keys and credentials used by Dokploy to manage remote servers if compromise is suspected.

Patch Information

Refer to the Dokploy GitHub Security Advisory GHSA-qcf5-jjjp-7794 for the fixed release version and upgrade instructions. Apply the patched version to all Dokploy instances managing production hosts.

Workarounds

Limit the ability to create or update file mounts to a minimal set of trusted accounts.
Place the Dokploy web interface behind a VPN or IP allow-list to reduce exposure of the authenticated attack surface.
Run the Dokploy SSH user with the least privileges required, avoiding direct root access on managed hosts where feasible.

bash

# Configuration example: restrict Dokploy web interface exposure
# Example nginx allow-list snippet in front of Dokploy
location / {
    allow 10.0.0.0/8;      # internal admin network
    deny  all;
    proxy_pass http://dokploy_upstream;
}