CVE-2026-72868

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13

Description Dokploy is a self-hostable Platform as a Service (PaaS). A shell injection flaw exists in the apps/dokploy/server/api/routers/destination.ts file where the destination.testConnection mutation interpolates the accessKey, secretAccessKey, region, endpoint, provider, and bucket fields into an rclone ls command executed via child process.exec. A low-privileged organization member with withPermission("destination", "create") privileges can use a crafted field to close a quoted argument and execute arbitrary commands within the root Dokploy container, which possesses access to the host Docker socket.

Recommendations Update to version 0.29.13.