CVE-2026-72733

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13

Description An authenticated member with backup-restore permissions can execute arbitrary operating-system commands in the host context via execAsync or execAsyncRemote. This occurs because the backup.restoreBackupWithLogs tRPC subscription fails to properly sanitize the databaseName and backupFile variables before incorporating them into shell pipelines. Specifically, databaseName is interpolated into database restore commands within packages/server/src/utils/restore/utils.ts, and backupFile is interpolated into rclone paths within packages/server/src/utils/restore/postgres.ts and similar restore modules.

Recommendations Update to version 0.29.13.