# CVE-2026-72735: Dokploy command injection in Traefik configuration

Source: https://junglewise.ai/threats/cve-2026-72735-dokploy-command-injection-in-traefik-configuration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-72735 · Severity: critical · CVSS 9.9 · Published 2026-08-10

Dokploy is an open-source Platform as a Service (PaaS) tool that allows users to self-host and manage applications and services. A critical vulnerability in how Dokploy processes Traefik proxy configurations allows attackers to execute arbitrary commands on remote servers managed by Dokploy. An attacker who can modify application configuration settings (such as redirect rules, authentication credentials, or domain names) can inject shell metacharacters to break out of intended quoting and run malicious code with the privileges of the SSH user connecting to those servers.

Technologies: [Dokploy](https://junglewise.ai/threats/technologies/dokploy). Vendors: [Dokploy](https://junglewise.ai/threats/vendors/dokploy).

## Quick answers

**Is CVE-2026-72735 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-72735 being exploited in the wild.

**How severe is CVE-2026-72735?** Critical severity, with a CVSS score of 9.9, published 10 August 2026.

**Which products and versions are affected?** Dokploy before 0.29.13.

**Is there a fix for CVE-2026-72735?** A patch was published on 2026-07-21: Version 0.29.13 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-72735 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-72735?** Check whether you run Dokploy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a shell command injection flaw in the writeTraefikConfigRemote function within packages/server/src/utils/traefik/application.ts. The code serializes user-controlled Traefik configuration using yaml.stringify and directly interpolates the resulting YAML string into an echo command executed via SSH (execAsyncRemote). Single quotes in redirect regex/replacement fields, basic authentication usernames, domain host values, or middleware configuration are not properly escaped, allowing attackers to terminate the shell quoting and inject arbitrary shell commands. An authenticated attacker with the ability to modify application configuration can exploit this to achieve remote code execution on managed servers with the privileges of the configured SSH user. This is a regression—an incomplete fix for CVE-2026-45630. The patch in version 0.29.13 base64-encodes the remote Traefik YAML and escapes config paths to prevent command injection.

## Affected products

- Dokploy Dokploy before 0.29.13

## Timeline

- 2026-08-10: disclosed
- 2026-07-21: patched: Version 0.29.13 released with fix

## References

- [https://github.com/Dokploy/dokploy/commit/92310ddb143c8e67ca95eb7db661838a76579f2e](https://github.com/Dokploy/dokploy/commit/92310ddb143c8e67ca95eb7db661838a76579f2e)
- [https://github.com/Dokploy/dokploy/releases/tag/v0.29.13](https://github.com/Dokploy/dokploy/releases/tag/v0.29.13)

## Related threats

- [Dokploy missing ownership check in application monitoring](https://junglewise.ai/threats/cve-2026-127212-dokploy-before-0-31-1-contains-a-missing-ownership-check)
- [Dokploy authorization bypass in application management](https://junglewise.ai/threats/cve-2026-116068-dokploy-through-0-30-10-contains-an-authorization-bypass)
- [Dokploy cross-organization authorization bypass in port router](https://junglewise.ai/threats/cve-2026-111331-dokploy-through-0-30-8-contains-a-cross-organization)
- [Dokploy OS command injection in patch repository read](https://junglewise.ai/threats/cve-2026-93425-dokploy-is-a-free-self-hostable-platform-as-a-service-paas-prior)
- [Dokploy credential disclosure in provider APIs](https://junglewise.ai/threats/cve-2026-86059-dokploy-is-a-free-self-hostable-platform-as-a-service-paas-prior)