CVE-2026-72735

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13

Description In the writeTraefikConfigRemote function within packages/server/src/utils/traefik/application.ts, user-controlled Traefik configuration is serialized using yaml.stringify and then interpolated into an echo command executed via execAsyncRemote. An attacker can use single quotes in basic authentication usernames, domain host values, middleware configuration, or redirect regex and replacement fields to terminate shell quoting. This allows the execution of arbitrary commands on managed remote servers with the privileges of the configured SSH user.

Recommendations Update to version 0.29.13.