Do Son 
A severe Dokploy OS command injection vulnerability threatens self-hosted Platform as a Service (PaaS) environments. Tracked in vulnerability note VU#280377 and assigned CVE-2026-72878, this critical flaw enables authenticated users to execute malicious shell commands as root. Consequently, organizations using vulnerable Dokploy versions must deploy the official 0.29.13 update immediately.
Track every CVE that hits your stack the moment it's exploited.
Get free email alertsWhy This Threat Matters
Dokploy allows developers to host and manage diverse applications and databases efficiently. Because the internal backup processes execute with root privileges by default, this Dokploy OS command injection grants intruders absolute control over the host server. Attackers can exploit this access to read or overwrite the host filesystem permanently. Furthermore, malicious users can extract private credentials and secrets belonging to other tenants sharing the same infrastructure.
How the Attack Works
The vulnerability occurs within the tRPC procedures handling database backup creation and restoration. When generating backup commands, the application interpolates user-controlled parameters, such as the database name or the backupFile value, directly into shell execution strings.
Unfortunately, the input validation only checks that the supplied values are non-empty strings. The application fails to sanitize these inputs or restrict shell metacharacters before invoking /bin/bash as a child process. Consequently, an attacker can append malicious characters to the input variables, forcing the host to execute unauthorized commands. Security researchers confirm that this exploit is reliable, but active in-the-wild exploitation remains unconfirmed.
Affected Versions
This command injection vulnerability affects all five supported databases: PostgreSQL, MySQL, MariaDB, MongoDB, and LibSQL. Security analysts confirmed exploitation against Dokploy versions 0.29.8 and 0.29.11, as well as commit 24b02f5 on the canary branch.
Patch and Mitigation Steps
Administrators must upgrade their instances to Dokploy version 0.29.13 or newer to resolve this flaw completely. You can review the complete technical details in the CERT/CC vulnerability note VU#280377. If an immediate upgrade is impossible, administrators should disable default backup permissions and restrict these functions to highly trusted administrative roles.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
