What’s Vulnerable › Vulnerabilities

CVE-2026-72865: Dokploy: OS Command Injection via compose `composePath`

• Severity: critical (CVSS 9.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-10 · updated 2026-09-08
• Weakness: CWE-78

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the compose.update operation stores an unvalidated composePath that packages/server/src/utils/builders/compose.ts and packages/server/src/services/compose.ts interpolate into docker compose -f, docker stack deploy -c, and touch shell commands executed through /bin/sh -c. An authenticated member with compose write and deploy permission can supply a crafted composePath, trigger compose.deploy or startCompose, and execute arbitrary operating-system commands in the Docker-privileged Dokploy host context. This issue is fixed in version 0.29.13.

Affected products

• dokploy: before 0.29.13

References

• https://github.com/Dokploy/dokploy/commit/d48037a80203bb0ecaec4f5653aef75fcfdb656d
• https://github.com/Dokploy/dokploy/pull/4863
• https://github.com/Dokploy/dokploy/releases/tag/v0.29.13
• https://github.com/Dokploy/dokploy/security/advisories/GHSA-8r5w-vqjr-8c44
• https://github.com/Dokploy/dokploy/security/advisories/GHSA-8r5w-vqjr-8c44

Get alerted when CVE-2026-72865 or the next vulnerability affects your stack