CVE-2026-72884

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, sanitizeCommand in packages/server/src/utils/builders/compose.ts only trims whitespace and strips surrounding quotes from compose.command before exportEnvCommand and docker command interpolation, allowing an...

CVE-2026-72881

Dokploy (PaaS) is affected before 0.29.13 by a command injection in the backup/restore code paths. The vulnerable components are database backup and restore command builders in packages/server/src/utils/backups/utils.ts and packages/server/src/utils/restore/utils.ts, which interpolate database na...

CVE-2026-72875

CVE-2026-72875 — Dokploy RCE via command injection : In Dokploy prior to 0.29.13, a vulnerability exists in settings.readTraefikFile where a path accepted by apiReadTraefikConfig is passed to readConfigInPath, and configPath is interpolated into execAsyncRemote as cat ${configPath}. This allows a...

CVE-2026-72871 Dokploy: Unauthenticated Git Provider Injection via GitHub OAuth Callback

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the unauthenticated /api/providers/github/setup route in apps/dokploy/pages/api/providers/github/setup.ts trusts ghinit organizationId and userId values from the state parameter and calls createGithub in...

CVE-2026-72733

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds database restore shell pipelines from the user-controlled databaseName and backupFile fields without safely separating them from shell syntax...