CVE-2026-72869

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13

Description An authenticated user with backup:restore permissions can execute arbitrary commands on the Docker-privileged host. The issue occurs because the backup.restoreBackupWithLogs tRPC subscription passes the databaseName parameter to restore builders in packages/server/src/utils/restore/utils.ts. For PostgreSQL, MariaDB, MySQL, and MongoDB, this value is embedded in nested shell text executed by Node.js exec, allowing the host /bin/sh to expand a crafted databaseName before the docker exec command is run.

Recommendations Update to version 0.29.13.