CVE-2026-72740

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13

Description Dokploy is a self-hostable Platform as a Service (PaaS). An authenticated member with service deployment permissions and an attached SSH key can execute arbitrary commands on the host during deployment. This occurs because the sanitizeRepoPathSSH function in packages/server/src/utils/providers/git.ts parses the user-controlled customGitUrl and interpolates its domain into the ssh-keyscan command within addHostToKnownHostsCommand without proper shell quoting.

Recommendations Update to version 0.29.13.