CVE-2026-72878

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13

Description The backup and restore pipeline constructs shell commands by directly interpolating user-controlled database fields into bash -c and sh -c strings, which are then executed via the child process.exec() function. This allows an authenticated admin or owner to perform OS command injection, executing arbitrary commands on the host machine running the platform rather than being restricted to a container.

Recommendations Update to version 0.29.13.