CVE-2026-72738

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13

Description An authenticated user with backup:read permission can execute arbitrary commands on the host. This occurs because the backup.listBackupFiles tRPC endpoint in apps/dokploy/server/api/routers/backup.ts processes the search parameter through normalizeS3Path and interpolates it into an rclone lsjson command executed via child process.exec(). This sequence allows for command injection.

Recommendations Update to version 0.29.13.