CVE-2026-72879

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.8

Description The getRegistryCommands() function in packages/server/src/utils/cluster/upload.ts fails to escape the registry.password and registry.registryUrl variables when interpolating them into a shell command. An authenticated user with project access can exploit this by configuring malicious registry credentials and triggering a swarm deployment to execute arbitrary operating system commands on the server, modify or read host files, and access other containers via Docker.

Recommendations Update to version 0.29.8.