by Kastro
Paper/Archive/CVE-2026-72879

CVE-2026-72879

Dokploy dokploy — Dokploy: Command Injection via Registry Credentials in Swarm Upload

EPSS 0.5%public exploitCVSS 9.4
critical.is priorityof 100
47
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 41.7.417 × 208.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.8, the getRegistryCommands() function in packages/server/src/utils/cluster/upload.ts interpolates registry.password and registry.registryUrl directly into a shell command without escaping. An authenticated user with project access can configure malicious registry credentials and trigger a swarm deployment to execute arbitrary OS commands on the Dokploy server, read or modify host files, and access other containers through Docker. This issue is fixed in version 0.29.8.

Affected

ProductAffectedFixed inSource
dokploy< 0.29.8–CNA

Scores by source

GitHub_M (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/Dokploy/dokploy/security/advisories/GHSA-prwq-2mcm-mvhrrefgithub.com/Dokploy/dokploy/pull/4579refgithub.com/Dokploy/dokploy/commit/1f4f94042f1d874349c42d8ae7fee51346cd086erefgithub.com/Dokploy/dokploy/releases/tag/v0.29.8