CVE-2026-72739

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-72739

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72739.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-72739

Aliases

GHSA-5xv2-7f8w-9j5c

Published

2026-08-10T17:53:33Z

Modified

2026-10-28T02:31:01Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Dokploy: Command Injection via Compose Shell Execution

Details

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the createCommand() function constructs shell commands by interpolating compose service names and configuration into bash command strings. When a compose with a maliciously crafted name or service definition is deployed, the shell metacharacters are interpreted as command separators, allowing arbitrary command execution on the Docker host. This vulnerability is fixed in 0.29.13.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-78"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72739.json"
}

References

Affected packages

Git / github.com/dokploy/dokploy

Affected ranges

Type

GIT

Repo

https://github.com/dokploy/dokploy

Events

Introduced

Fixed

8b868c66d6672be40b86315a704ea1b3b09cb2d3

Fixed

d48037a80203bb0ecaec4f5653aef75fcfdb656d

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "0.29.13"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "d48037a80203bb0ecaec4f5653aef75fcfdb656d"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v0.29.13",
            "range":  [
                {
                    "fixed":  "8b868c66d6672be40b86315a704ea1b3b09cb2d3"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

v0.*

v0.0.1

v0.0.2

v0.0.3

v0.0.4

v0.1.0

v0.10.0

v0.10.1

v0.10.10

v0.10.2

v0.10.3

v0.10.4

v0.10.5

v0.10.6

v0.10.7

v0.10.9

v0.11.0

v0.11.1

v0.11.2

v0.12.0

v0.13.0

v0.13.1

v0.14.0

v0.14.1

v0.15.0

v0.15.1

v0.16.0

v0.16.1

v0.17.0

v0.17.1

v0.17.2

v0.17.3

v0.2.1

v0.2.2

v0.2.3

v0.2.4

v0.2.5

v0.29.10

v0.29.11

v0.29.12

v0.29.7

v0.29.8

v0.29.9

v0.3.0

v0.3.1

v0.3.2

v0.3.3

v0.4.0

v0.5.0

v0.5.1

v0.6.0

v0.6.1

v0.6.2

v0.6.3

v0.7.0

v0.7.1

v0.7.2

v0.7.3

v0.8.0

v0.8.1

v0.8.2

v0.8.3

v0.9.0

v0.9.1

v0.9.2

v0.9.3

v0.9.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72739.json"