CVE-2026-72877— Dokploy: Command Injection via dockerImage in buildRemoteDocker
Possible ATT&CK Techniques 1AI
T1059 · Command and Scripting InterpreterGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-72877
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Dokploy: Command Injection via dockerImage in buildRemoteDocker
Source: CVE Program / CVE List V5
Vulnerability Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the dockerImage field is interpolated without quoting into shell commands in buildRemoteDocker() in packages/server/src/utils/providers/docker.ts and is validated only as an optional string. An authenticated user with application create or update permission can use shell command substitution in dockerImage to execute arbitrary commands on the local build host or a remote SSH build target, exposing host secrets and other projects. This issue is fixed in version 0.29.13.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-72877
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 5076 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-72877
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-72877 (2)
Vendor Advisories for CVE-2026-72877 (1)
Vendor Pages for CVE-2026-72877 (1)
Same Patch Batch · Dokploy · 2026-08-10 · 35 CVEs total
| CVE-2026-72868 | 9.9 CRITICAL | Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injectio |
| CVE-2026-72901 | 9.9 CRITICAL | Dokploy: Remote Code Execution via volume-backup |
| CVE-2026-72902 | 9.9 CRITICAL | Dokploy: Authenticated RCE via Command Injection in registry.testRegistry / registry.testR |
| CVE-2026-72882 | 9.9 CRITICAL | Dokploy: Authenticated blind command injection via file mounts leads to direct remote host |
| CVE-2026-72880 | 9.9 CRITICAL | Dokploy: Arbitrary File Write + Remote OS Command Injection via `certificatePath` |
| CVE-2026-72886 | 9.9 CRITICAL | Dokploy: Non-admin member gains root on the host by bypassing the owner/admin check on ser |
| CVE-2026-72876 | 9.9 CRITICAL | Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.* |
| CVE-2026-72867 | 9.9 CRITICAL | Dokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields |
| CVE-2026-72733 | 9.9 CRITICAL | Dokploy: OS Command Injection via `databaseName` / `backupFile` in database restore |
| CVE-2026-72864 | 9.9 CRITICAL | Dokploy Broken Access Control on docker-container-terminal WebSocket (Member -> Root in Ar |
| CVE-2026-72869 | 9.9 CRITICAL | Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) |
| CVE-2026-72872 | 9.9 CRITICAL | Dokploy: OS Command Injection via Bitbucket `owner`/`repository` in `git clone` |
| CVE-2026-72863 | 9.9 CRITICAL | Dokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain |
| CVE-2026-72865 | 9.9 CRITICAL | Dokploy: OS Command Injection via compose `composePath` |
| CVE-2026-72740 | 9.9 CRITICAL | Dokploy: OS Command Injection via SSH-form `customGitUrl` domain in `ssh-keyscan` |
| CVE-2026-72735 | 9.9 CRITICAL | Dokploy: Command injection in writeTraefikConfigRemote via shell interpolation of unescape |
| CVE-2026-72736 | 9.9 CRITICAL | Dokploy: OS Command Injection in registry credential testing and Swarm cluster management |
| CVE-2026-72862 | 9.9 CRITICAL | Dokploy: OS Command Injection via dockerImage field in database service deployment functio |
| CVE-2026-72738 | 9.9 CRITICAL | Dokploy: Authenticated RCE via Command Injection in backup.listBackupFiles search Paramete |
| CVE-2026-72737 | 9.6 CRITICAL | Dokploy: Cross-organization IDOR in Dokploy backup destinations exposes another tenant's S |
Showing top 20 of 35 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: dokploy
- CVE-2026-72902
Dokploy: Authenticated RCE via Command Injection in registry - CVE-2026-72901
Dokploy: Remote Code Execution via volume-backup - CVE-2026-72886
Dokploy: Non-admin member gains root on the host by bypassin - CVE-2026-72885
Dokploy: Authenticated Command Injection in Dokploy Dockerfi - CVE-2026-72884
Dokploy: Command Injection via Compose Custom Command
Same vendor: Dokploy
- CVE-2026-72902
Dokploy: Authenticated RCE via Command Injection in registry - CVE-2026-72901
Dokploy: Remote Code Execution via volume-backup - CVE-2026-72886
Dokploy: Non-admin member gains root on the host by bypassin - CVE-2026-72885
Dokploy: Authenticated Command Injection in Dokploy Dockerfi - CVE-2026-72884
Dokploy: Command Injection via Compose Custom Command
Same weakness: CWE-78
- CVE-2026-49819
UpSnap - Unauthenticated Initial-Superuser Takeover Chains t - CVE-2026-17431
PDF::WebKit versions through 1.2 for Perl allow OS command i - CVE-2026-49481
UpSnap vulnerable to Remote Code Execution via IP Field Temp - CVE-2026-13476
IBM Informix Wire Listener Vulnerable to Unauthenticated Rem - CVE-2026-16695
IBM i Access Client Solutions (ACS) is Affected By Multiple
V. Comments for CVE-2026-72877
No comments yet