CVE-2026-72869

creationtimestamp| type| source ---|---|--- 2026-08-10 19:34:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msqtrxiuce2v 2026-08-11 18:11:26+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mst7n4jegv2h 2026-08-11 18:11:40+00:00| seen|...

CVE-2026-72869 Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCE

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription passes the databaseName parameter to restore builders in packages/server/src/utils/restore/utils.ts, where PostgreSQL, MariaDB, MySQL, and MongoDB commands embed the...