CVE-2026-72865

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13

Description The compose.update operation stores an unvalidated composePath that is interpolated into docker compose -f, docker stack deploy -c, and touch shell commands executed via /bin/sh -c. An authenticated member with compose write and deploy permissions can provide a crafted composePath and trigger compose.deploy or startCompose to execute arbitrary operating-system commands within the Docker-privileged host context. This occurs within packages/server/src/utils/builders/compose.ts and packages/server/src/services/compose.ts.

Recommendations Update to version 0.29.13.