CVE-2026-72735
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed through execAsyncRemote. Single quotes in redirect regex and replacement fields, basic authentication usernames, domain host values, or middleware configuration can terminate the shell quoting and execute arbitrary commands on managed remote servers with the configured SSH user's privileges. This vulnerability is caused by an incomplete fix for CVE-2026-45630. This issue is fixed in version 0.29.13.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.9
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- EPSS probability
- 0.75%
- CWE
- CWE-77
- Published
- 2026-08-10
- Last modified
- 2026-08-10
Affected products
- Dokploy dokploy
Weakness type
Related vulnerabilities
- CVE-2026-47670 — DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection
- CVE-2026-86152 — Tenda CP3 Kylin AutoAddWifi.cpp ThreadProc os command injection
- CVE-2026-82971 — QVidium Opera11 CGI Script net_tr.cgi command injection
- CVE-2026-72869 — Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCE
- CVE-2026-72736 — Dokploy: OS Command Injection in registry credential testing and Swarm cluster management → HOST RCE
- CVE-2026-54680 — Logging operator has Fluentd configuration injection that allows remote code execution
- CVE-2026-28672 — Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder
- CVE-2026-20325 — Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Improper Neutralization of Special Elements used in a Command