Vulnerability Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the createCommand() function constructs shell commands by interpolating compose service names and configuration into bash command strings. When a compose with a maliciously crafted name or service definition is deployed, the shell metacharacters are interpreted as command separators, allowing arbitrary command execution on the Docker host. This vulnerability is fixed in 0.29.13.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/Dokploy/dokploy/commit/d48037a80203bb0ecaec4f5653aef75fcfdb65
- https://github.com/Dokploy/dokploy/releases/tag/v0.29.13
- https://github.com/Dokploy/dokploy/security/advisories/GHSA-5xv2-7f8w-9j5c
- https://github.com/Dokploy/dokploy/security/advisories/GHSA-5xv2-7f8w-9j5c
FAQ
What is CVE-2026-72739?
CVE-2026-72739 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the createCommand() function constructs shell commands by interpolating compose service names and configuration into ba...
How severe is CVE-2026-72739?
CVE-2026-72739 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-72739?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.