by Kastro
Paper/Archive/CVE-2026-72872

CVE-2026-72872

Dokploy dokploy — Dokploy: OS Command Injection via Bitbucket `owner`/`repository` in `git clone`

EPSS 0.7%public exploitCVSS 9.9
critical.is priorityof 100
50
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 51.1.511 × 2010.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, application.saveBitbucketProvider stores bitbucketOwner and bitbucketRepository without validation and cloneBitbucketRepository in packages/server/src/utils/providers/bitbucket.ts interpolates those values into git clone commands executed through execAsync or execAsyncRemote, allowing a member with service deployment permission to execute arbitrary operating system commands on the Dokploy host or target server. This issue is fixed in version 0.29.13.

Affected

ProductAffectedFixed inSource
dokploy< 0.29.13–CNA

Scores by source

GitHub_M (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/Dokploy/dokploy/security/advisories/GHSA-grrj-6xrh-j6vprefgithub.com/Dokploy/dokploy/pull/4855refgithub.com/Dokploy/dokploy/commit/47347ab885b0ad1f5d0ef0e5e74bbba35c7f93bcrefgithub.com/Dokploy/dokploy/releases/tag/v0.29.13