PT-2026-69886 · Dokploy · Dokploy
CVE-2026-72739
·
Published
2026-08-10
·
Updated
2026-08-10
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Dokploy versions prior to 0.29.13
Description
The
createCommand() function constructs shell commands by interpolating compose service names and configuration into bash command strings. If a compose file with a maliciously crafted name or service definition is deployed, shell metacharacters are interpreted as command separators, enabling arbitrary command execution on the Docker host.Recommendations
Update to version 0.29.13.
Exploit
Fix
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Dokploy