CVE-2026-72902

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server because registry.testRegistry and registry.testRegistryById in apps/dokploy/server/api/routers/registry.ts...

CVE-2026-72901

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy allows an authenticated low-privilege member to execute arbitrary commands on the control-plane host because the volumeName field accepted by volumeBackup.create and volumeBackup.runManually is interpolated...

CVE-2026-72901

CVE-2026-72901 affects Dokploy before version 0.29.13. An authenticated low-privilege user could run arbitrary commands on the control-plane host due to the volumeName field used by volumeBackup.create/runManually being interpolated without quoting in packages/server/src/utils/volume-backups/back...

CVE-2026-72880 Dokploy: Arbitrary File Write + Remote OS Command Injection via `certificatePath`

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the apiCreateCertificate schema in packages/server/src/db/schema/certificate.ts accepts a client-supplied certificatePath, and packages/server/src/services/certificate.ts joins that value to the certificate root withou...

CVE-2026-72871

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the unauthenticated /api/providers/github/setup route in apps/dokploy/pages/api/providers/github/setup.ts trusts ghinit organizationId and userId values from the state parameter and calls createGithub in...

CVE-2026-72878

CVE-2026-72878 : Dokploy before 0.29.13 is vulnerable to OS command injection in the backup/restore pipeline. The system constructs shell commands by directly interpolating user-controlled database fields into bash -c and sh -c strings, then executes them via child_process.exec(), allowing an aut...

CVE-2026-72878

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy's backup and restore pipeline constructs shell commands by directly interpolating user-controlled database fields into bash -c "..." and sh -c "..." strings, then executes them via childprocess.exec. An...

CVE-2026-72876

Dokploy (free self-hosted PaaS) contains a high-severity vulnerability prior to 0.29.13 where cross-organization checks fail in swarm endpoints (swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, swarm.getAppInfos) and getNodeInfo interpolates nodeId into execAsyncRemote. This allows a caller ...

CVE-2026-72875

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, settings.readTraefikFile in apps/dokploy/server/api/routers/settings.ts passes a path accepted by apiReadTraefikConfig to readConfigInPath in packages/server/src/utils/traefik/application.ts, where configPath is...

CVE-2026-72873

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, application.one in apps/dokploy/server/api/routers/application.ts returns provider relations loaded by findApplicationById in packages/server/src/services/application.ts without redacting githubClientSecret,...

CVE-2026-72870

Dokploy's buildRemoteDocker vulnerability affects Dokploy before 0.29.13. The buildRemoteDocker() function interpolates the application-controlled dockerImage value directly into a docker pull command, enabling an authenticated user with project access to craft a dockerImage via application.updat...

CVE-2026-72740

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, packages/server/src/utils/providers/git.ts parses the user-controlled customGitUrl with sanitizeRepoPathSSH and interpolates its domain into the ssh-keyscan command from addHostToKnownHostsCommand without shell quoting...