CVE-2026-72739— Dokploy: Command Injection via Compose Shell Execution
Possible ATT&CK Techniques 1AI
T1059 · Command and Scripting InterpreterGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-72739
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Dokploy: Command Injection via Compose Shell Execution
Source: CVE Program / CVE List V5
Vulnerability Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the createCommand() function constructs shell commands by interpolating compose service names and configuration into bash command strings. When a compose with a maliciously crafted name or service definition is deployed, the shell metacharacters are interpreted as command separators, allowing arbitrary command execution on the Docker host. This vulnerability is fixed in 0.29.13.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-72739
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-72739
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-72739 (1)
Vendor Advisories for CVE-2026-72739 (1)
Vendor Pages for CVE-2026-72739 (1)
Same Patch Batch · Dokploy · 2026-08-10 · 35 CVEs total
| CVE-2026-72867 | 9.9 CRITICAL | Dokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields |
| CVE-2026-72901 | 9.9 CRITICAL | Dokploy: Remote Code Execution via volume-backup |
| CVE-2026-72902 | 9.9 CRITICAL | Dokploy: Authenticated RCE via Command Injection in registry.testRegistry / registry.testR |
| CVE-2026-72882 | 9.9 CRITICAL | Dokploy: Authenticated blind command injection via file mounts leads to direct remote host |
| CVE-2026-72880 | 9.9 CRITICAL | Dokploy: Arbitrary File Write + Remote OS Command Injection via `certificatePath` |
| CVE-2026-72886 | 9.9 CRITICAL | Dokploy: Non-admin member gains root on the host by bypassing the owner/admin check on ser |
| CVE-2026-72876 | 9.9 CRITICAL | Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.* |
| CVE-2026-72733 | 9.9 CRITICAL | Dokploy: OS Command Injection via `databaseName` / `backupFile` in database restore |
| CVE-2026-72868 | 9.9 CRITICAL | Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injectio |
| CVE-2026-72864 | 9.9 CRITICAL | Dokploy Broken Access Control on docker-container-terminal WebSocket (Member -> Root in Ar |
| CVE-2026-72869 | 9.9 CRITICAL | Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) |
| CVE-2026-72865 | 9.9 CRITICAL | Dokploy: OS Command Injection via compose `composePath` |
| CVE-2026-72872 | 9.9 CRITICAL | Dokploy: OS Command Injection via Bitbucket `owner`/`repository` in `git clone` |
| CVE-2026-72740 | 9.9 CRITICAL | Dokploy: OS Command Injection via SSH-form `customGitUrl` domain in `ssh-keyscan` |
| CVE-2026-72738 | 9.9 CRITICAL | Dokploy: Authenticated RCE via Command Injection in backup.listBackupFiles search Paramete |
| CVE-2026-72863 | 9.9 CRITICAL | Dokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain |
| CVE-2026-72735 | 9.9 CRITICAL | Dokploy: Command injection in writeTraefikConfigRemote via shell interpolation of unescape |
| CVE-2026-72736 | 9.9 CRITICAL | Dokploy: OS Command Injection in registry credential testing and Swarm cluster management |
| CVE-2026-72862 | 9.9 CRITICAL | Dokploy: OS Command Injection via dockerImage field in database service deployment functio |
| CVE-2026-72877 | 9.6 CRITICAL | Dokploy: Command Injection via dockerImage in buildRemoteDocker |
Showing top 20 of 35 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: dokploy
- CVE-2026-72902
Dokploy: Authenticated RCE via Command Injection in registry - CVE-2026-72901
Dokploy: Remote Code Execution via volume-backup - CVE-2026-72886
Dokploy: Non-admin member gains root on the host by bypassin - CVE-2026-72885
Dokploy: Authenticated Command Injection in Dokploy Dockerfi - CVE-2026-72884
Dokploy: Command Injection via Compose Custom Command
Same vendor: Dokploy
- CVE-2026-72902
Dokploy: Authenticated RCE via Command Injection in registry - CVE-2026-72901
Dokploy: Remote Code Execution via volume-backup - CVE-2026-72886
Dokploy: Non-admin member gains root on the host by bypassin - CVE-2026-72885
Dokploy: Authenticated Command Injection in Dokploy Dockerfi - CVE-2026-72884
Dokploy: Command Injection via Compose Custom Command
Same weakness: CWE-78
- CVE-2026-58236
OS Command Injection vulnerability in Application Server ABA - CVE-2025-30241
OS Command Injection in Web Interface in Multiple TP-Link Ag - CVE-2026-72902
Dokploy: Authenticated RCE via Command Injection in registry - CVE-2026-72901
Dokploy: Remote Code Execution via volume-backup - CVE-2026-72885
Dokploy: Authenticated Command Injection in Dokploy Dockerfi
V. Comments for CVE-2026-72739
No comments yet