CVE-2026-72885

Dokploy: Authenticated Command Injection in Dokploy Dockerfile Builder

0.0 None

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, dockerContextPath accepted by apps/dokploy/components/dashboard/application/build/show.tsx flows through getDockerContextPath in packages/server/src/utils/filesystem/directory.ts into the unquoted cd command in packages/server/src/utils/builders/docker-file.ts before execution by execAsync, allowing an authenticated application editor to execute arbitrary commands on the Dokploy host. This issue is fixed in version 0.29.13.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: None

Exploit likelihood

0.82%Up 0.2 points since Aug 11, 2026

What each source reports

CVE List Score used 0.0

Dokploy: Authenticated Command Injection in Dokploy Dockerfile Builder

Record: CVE-2026-72885
CVSS 4.0: 0.0 NoneCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-78
Updated: 2026-11-02

EUVDEUVD-2026-55795 No score

Record: EUVD-2026-55795
Updated: 2026-11-02

NVD 0.0

Record: CVE-2026-72885
CVSS 4.0: 0.0 NoneCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-78
Updated: 2026-11-02

OSV 0.0

Dokploy: Authenticated Command Injection in Dokploy Dockerfile Builder

Record: CVE-2026-72885
CVSS 4.0: 0.0 NoneCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-78
Updated: 2026-11-02

Affected products

dokploy

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-72885 is a none vulnerability (CVSS 0.0) in Dokploy, published August 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.82%, the 57th percentile. No source names a fixed version.