EUVD-2026-55679

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds database restore shell pipelines from the user-controlled databaseName and backupFile fields without safely separating them from shell syntax...

CVE-2026-72733 Dokploy: OS Command Injection via `databaseName` / `backupFile` in database restore

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds database restore shell pipelines from the user-controlled databaseName and backupFile fields without safely separating them from shell syntax...

CVE-2026-72733 Dokploy: OS Command Injection via `databaseName` / `backupFile` in database restore

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds database restore shell pipelines from the user-controlled databaseName and backupFile fields without safely separating them from shell syntax...

CVE-2026-72733 Dokploy: OS Command Injection via `databaseName` / `backupFile` in database restore

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds database restore shell pipelines from the user-controlled databaseName and backupFile fields without safely separating them from shell syntax...

CVE-2026-72877: Improper Neutralization of Special Elements used in an OS Command

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the dockerImage field is interpolated without quoting into shell commands in buildRemoteDocker in packages/server/src/utils/providers/docker.ts and is validated only as an optional string. An authenticated user with...

PT-2026-69911

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description Dokploy is a self-hostable Platform as a Service PaaS. The buildRemoteDocker function in packages/server/src/utils/providers/docker.ts interpolates the dockerImage value directly into a docker pull...

CVE-2026-72862: Improper Neutralization of Special Elements used in an OS Command

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts Dokploy database service deployment functions pass user-controlled dockerImage fields unquoted into docker pull $dockerImage shell commands on th...

CVE-2026-72870: Improper Neutralization of Special Elements used in an OS Command

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the buildRemoteDocker function in packages/server/src/utils/providers/docker.ts interpolates the application-controlled dockerImage value directly into a docker pull shell command. An authenticated user with project...

PT-2026-69888

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description Dokploy is a self-hostable Platform as a Service PaaS. The database service deployment functions within mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts pass the user-controlled...

PT-2026-69921

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description Dokploy is a self-hostable Platform as a Service PaaS. The application fails to perform an activeOrganizationId ownership check when processing the serverId parameter in the following API endpoints...

PT-2026-69909

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description Dokploy is a self-hostable Platform as a Service PaaS. A shell injection flaw exists in the apps/dokploy/server/api/routers/destination.ts file where the destination.testConnection mutation...

CVE-2026-72871: Missing Authentication for Critical Function

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the unauthenticated /api/providers/github/setup route in apps/dokploy/pages/api/providers/github/setup.ts trusts ghinit organizationId and userId values from the state parameter and calls createGithub in...

PT-2026-69934

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description Dokploy is a self-hostable Platform as a Service PaaS. An authenticated user with permissions to create or delete certificates can exploit a path traversal issue. The apiCreateCertificate schema in...

PT-2026-69937

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description Dokploy is a self-hostable Platform as a Service PaaS. An authenticated organization member can obtain root terminal access and read logs or statistics for restricted servers and services. This...

PT-2026-69907

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description The WebSocket handler in apps/dokploy/server/wss/terminal.ts validates sessions but fails to authorize access to the requested server. An authenticated user can access the /terminal?serverId=local...

PT-2026-69883

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description An authenticated user with backup:read permission can execute arbitrary commands on the host. This occurs because the backup.listBackupFiles tRPC endpoint in apps/dokploy/server/api/routers/backup....

PT-2026-69904

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description WebSocket handlers used for in-app terminals and log streamers authenticate sessions using the validateRequest function but fail to perform authorization. Because they do not consult the role and...

PT-2026-69878

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description An authenticated member with backup-restore permissions can execute arbitrary operating-system commands in the host context via execAsync or execAsyncRemote. This occurs because the...

CVE-2026-72873: Exposure of Sensitive Information to an Unauthorized Actor

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, application.one in apps/dokploy/server/api/routers/application.ts returns provider relations loaded by findApplicationById in packages/server/src/services/application.ts without redacting githubClientSecret,...

PT-2026-69913

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description Dokploy is a self-hostable Platform as a Service PaaS. A flaw exists where the application.saveBitbucketProvider function stores bitbucketOwner and bitbucketRepository without proper validation...