CVE-2026-72901: Dokploy RCE Vulnerability

CVE-2026-72901 Overview

Dokploy is a free, self-hostable Platform as a Service (PaaS). Versions prior to 0.29.13 contain an OS command injection flaw [CWE-78] that allows an authenticated low-privilege member to execute arbitrary commands on the control-plane host. The volumeName field accepted by volumeBackup.create and volumeBackup.runManually is interpolated without quoting in packages/server/src/utils/volume-backups/backup.ts and executed through child_process.exec. Because Dokploy operates with Docker socket access, command execution is host and root equivalent. The issue is fixed in version 0.29.13.

Critical Impact
Any authenticated low-privilege Dokploy member can achieve root-equivalent code execution on the control-plane host through unsanitized volume name input.

Affected Products

Dokploy versions prior to 0.29.13
Self-hosted Dokploy PaaS deployments
Dokploy instances with volumeBackup functionality exposed to member-level users

Discovery Timeline

2026-08-10 - CVE-2026-72901 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-72901

Vulnerability Analysis

The vulnerability resides in Dokploy's volume backup subsystem. The volumeName parameter submitted to the volumeBackup.create and volumeBackup.runManually tRPC endpoints flows directly into a shell command string. The application then passes that concatenated string to child_process.exec, which invokes /bin/sh -c.

Because the value is interpolated without quoting or escaping, an attacker can break out of the intended argument context using shell metacharacters. Payloads containing backticks, $(), semicolons, or pipes execute as separate shell commands. The Dokploy control-plane process holds an active Docker socket connection. Any command executed in that process context can create privileged containers, mount the host filesystem, or write to /var/run/docker.sock. This yields root-equivalent control over the underlying host.

Root Cause

The root cause is missing input validation on the volumeName field combined with unsafe string interpolation into a shell command in packages/server/src/utils/volume-backups/backup.ts. No allowlist regex enforced the Docker volume naming convention before the value reached exec.

Attack Vector

An authenticated user with the member role submits a crafted volumeName value through the volume backup creation or manual run API. The malicious payload is executed by the server process during backup command construction, granting the attacker shell access equivalent to the Dokploy service account.

typescript

// Security patch: introduce a strict allowlist for volume names
// Source: https://github.com/Dokploy/dokploy/commit/d629faebc6dcb9d4785f84bf30b2b285f9f59379
// File: packages/server/src/db/schema/utils.ts

export const APP_NAME_MESSAGE =
	"App name can only contain letters, numbers, dots, underscores and hyphens";

/** Docker volume name: must start alphanumeric, then letters/numbers/._- only. Safe for shell. */
export const VOLUME_NAME_REGEX = /^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/;

export const VOLUME_NAME_MESSAGE =
	"Volume name must start with a letter or number and contain only letters, numbers, dots, underscores and hyphens";

/** Database password: blocks shell-dangerous characters like $ ! ' " \ / and spaces. */
export const DATABASE_PASSWORD_REGEX =
	/^[a-zA-Z0-9@#%^&*()_+\-=[\]{}|;:,.<>?~`]*$/;

The patch introduces VOLUME_NAME_REGEX and wires it into the tRPC input schema used by apps/dokploy/server/api/routers/volume-backups.ts, rejecting any value that contains shell metacharacters before it reaches child_process.exec.

Detection Methods for CVE-2026-72901

Indicators of Compromise

Unexpected child processes spawned by the Dokploy Node.js runtime, particularly /bin/sh, curl, wget, or reverse shell binaries.
Volume backup records containing shell metacharacters such as `, $(, ;, |, or && in the volumeName field.
New or unauthorized containers created through the Docker socket shortly after a volumeBackup.create or volumeBackup.runManually API call.
Outbound network connections from the Dokploy host to unfamiliar destinations following volume backup operations.

Detection Strategies

Inspect Dokploy application logs and audit records for volumeBackup.create or volumeBackup.runManually calls with volumeName values that fail the ^[a-zA-Z0-9][a-zA-Z0-9_.-]*$ pattern.
Monitor process ancestry on the control-plane host for shell invocations descending from the Dokploy Node.js process.
Correlate low-privilege member API activity with Docker daemon events showing container creation using sensitive mounts such as /, /var/run/docker.sock, or /etc.

Monitoring Recommendations

Enable command-line logging for all processes launched by the Dokploy service account and forward events to a central SIEM.
Alert on any docker run invocation with --privileged, --pid=host, or host root bind mounts originating from the Dokploy host.
Track authentication events for member-role accounts that suddenly interact with the volume backup APIs.

How to Mitigate CVE-2026-72901

Immediate Actions Required

Upgrade Dokploy to version 0.29.13 or later without delay.
Audit all existing volumeBackup records and remove entries whose volumeName contains characters outside [a-zA-Z0-9._-].
Rotate secrets, API tokens, and SSH keys stored on the Dokploy control-plane host if any suspicious activity is observed.
Review the member role assignments and revoke access for accounts that do not require volume backup capabilities.

Patch Information

The fix is delivered in Dokploy release v0.29.13. The security advisory GHSA-w223-vw9m-4f9c documents the flaw, and the fix commit d629fae and pull request #4873 introduce a VOLUME_NAME_REGEX allowlist and file-name escaping in the volume backup path.

Workarounds

Restrict the Dokploy web UI and API to trusted network ranges until the upgrade is applied.
Temporarily disable the volume backup feature or revoke member-role permissions to invoke volumeBackup.create and volumeBackup.runManually.
Run the Dokploy control-plane container with a dedicated, least-privilege Docker socket proxy such as tecnativa/docker-socket-proxy to reduce blast radius.

bash

# Configuration example: verify installed Dokploy version and upgrade
docker exec dokploy sh -c 'cat /app/package.json | grep "\"version\""'

# Pull the patched image and redeploy
docker pull dokploy/dokploy:0.29.13
docker compose -f /etc/dokploy/docker-compose.yml up -d

# Confirm the upgrade
docker exec dokploy sh -c 'node -e "console.log(require(\"/app/package.json\").version)"'