PT-2026-69924
CVE-2026-72879
·
Published
2026-08-10
·
Updated
2026-08-10
Description by
CVSS 4.0
9.4
CriticalMetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Dokploy versions prior to 0.29.8
Description
The
getRegistryCommands() function in packages/server/src/utils/cluster/upload.ts fails to escape the registry.password and registry.registryUrl variables when interpolating them into a shell command. An authenticated user with project access can exploit this by configuring malicious registry credentials and triggering a swarm deployment to execute arbitrary operating system commands on the server, modify or read host files, and access other containers via Docker.Recommendations
Update to version 0.29.8.
Found an issue in the description? Have something to add? Feel free to write us 👾