CVE-2026-72874

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13

Description An authenticated user with application access can execute arbitrary operating system commands on the host. This occurs because the cloneGitRepository() function in packages/server/src/utils/providers/git.ts interpolates the customGitUrl and customGitBranch variables into a git clone command that is subsequently passed to execAsync() or execAsyncRemote(). An attacker can trigger this by providing a malicious custom Git URL and initiating a deployment.

Recommendations Update to version 0.29.13.