CVE-2026-72870

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13

Description Dokploy is a self-hostable Platform as a Service (PaaS). The buildRemoteDocker() function in packages/server/src/utils/providers/docker.ts interpolates the dockerImage value directly into a docker pull shell command. An authenticated user with project access can provide a crafted dockerImage via the application.update endpoint and trigger application.deploy, leading the execAsync() function to execute arbitrary operating-system commands with the privileges of the Dokploy server process.

Recommendations Update to version 0.29.13.