CVE-2026-72882

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.28.9

Description Dokploy is a free, self-hostable Platform as a Service (PaaS). An authenticated user with permissions to create or update file mounts for a service can inject shell metacharacters into the filePath variable. This allows the execution of attacker-controlled commands on the configured remote managed server via SSH, which, in the default deployment model, results in remote code execution (RCE) from the web interface.

Recommendations Update to a version newer than 0.28.8. Restrict the ability of users to create or update file mounts to only trusted administrators.