CVE Feed

    Dashboard / CVE / CVE-2026-72869

    CVE-2026-72869

    Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription passes the databaseName parameter to restore builders in packages/server/src/utils/restore/utils.ts, where PostgreSQL, MariaDB, MySQL, and MongoDB commands embed the value in nested shell text executed by Node.js exec. An authenticated user with backup:restore permission can supply a crafted databaseName that the host /bin/sh expands before docker exec, resulting in arbitrary commands running in the Docker-privileged host context. This issue is fixed in version 0.29.13.

    Published:Aug 10, 2026
    Last Modified:Aug 11, 2026
    EPS:Aug 10, 2026
    EPSS Score:0.00352
    CVSS Score:9.9

    Affected Products

    Vendor
    Dokploy
    Product
    Dokploy

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-82954 (CVSS 8.6) — A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the function writeTraefikConfigInPath…
    CVE-2026-45791 (CVSS 5.9) — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's user.update procedur…
    CVE-2026-45790 (CVSS 8) — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's organization.inviteM…
    CVE-2026-72902 (CVSS 9.9) — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticat…
    CVE-2026-72901 (CVSS 9.9) — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticat…
    CVE-2026-72886 (CVSS 9.9) — Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.2 until 0.29.13, schedule.create and …
    CVE-2026-72885 (CVSS 0) — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, dockerContextPath accepted by…
    CVE-2026-72884 (CVSS 8.7) — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, sanitizeCommand in packages/s…
    CVE-2026-72883 (CVSS 8.8) — Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the WebSocket handlers in app…
    CVE-2026-72882 (CVSS 9.9) — Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, an authenticated user wh…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High