CVE-2026-72901

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13

Description Dokploy is a self-hostable Platform as a Service (PaaS) that allows an authenticated low-privilege member to execute arbitrary commands on the control-plane host. The issue occurs because the volumeName field accepted by the volumeBackup.create and volumeBackup.runManually functions is interpolated without quoting in the packages/server/src/utils/volume-backups/backup.ts file and executed via child process.exec. Due to Docker socket access, this execution is equivalent to host root privileges.

Recommendations Update to version 0.29.13.