CVE-2026-72875

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, settings.readTraefikFile in apps/dokploy/server/api/routers/settings.ts passes a path accepted by apiReadTraefikConfig to readConfigInPath in packages/server/src/utils/traefik/application.ts, where configPath is...

CVE-2026-72875

CVE-2026-72875 — Dokploy RCE via command injection : In Dokploy prior to 0.29.13, a vulnerability exists in settings.readTraefikFile where a path accepted by apiReadTraefikConfig is passed to readConfigInPath, and configPath is interpolated into execAsyncRemote as cat ${configPath}. This allows a...