PT-2026-69935 · Dokploy · Dokploy
CVE-2026-72881
·
Published
2026-08-10
·
Updated
2026-08-10
CVSS v4.0
6.4
Medium
| Vector | AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Dokploy versions prior to 0.29.13
Description
Dokploy is a self-hostable Platform as a Service (PaaS). The database backup and restore command builders located in
packages/server/src/utils/backups/utils.ts and packages/server/src/utils/restore/utils.ts interpolate database names, usernames, and passwords into nested shell command strings passed to the child process.exec() function. An authenticated administrator with permissions to create databases and configure backups can use crafted database configuration fields to execute arbitrary commands inside PostgreSQL, MariaDB, MySQL, MongoDB, or LibSQL containers. This can lead to the exposure of database data and credentials, and may allow a container escape if the container is overprivileged.Recommendations
Update to version 0.29.13.
Exploit
Fix
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Dokploy