PT-2026-69883

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description An authenticated user with backup:read permission can execute arbitrary commands on the host. This occurs because the backup.listBackupFiles tRPC endpoint in apps/dokploy/server/api/routers/backup....

CVE-2026-72738: Improper Neutralization of Special Elements used in an OS Command

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the backup.listBackupFiles tRPC endpoint in apps/dokploy/server/api/routers/backup.ts passes the search parameter through normalizeS3Path and interpolates it into an rclone lsjson command executed by childprocess.exec,...