CVE-2026-72877

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13

Description An authenticated user with application create or update permissions can execute arbitrary commands on the local build host or a remote SSH build target. This occurs because the dockerImage field is interpolated without quoting into shell commands within the buildRemoteDocker() function located in packages/server/src/utils/providers/docker.ts, and is only validated as an optional string. This flaw allows for shell command substitution, which can expose host secrets and other projects.

Recommendations Update to version 0.29.13.