Is CVE-2026-72740 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-72740 being exploited in the wild.

How severe is CVE-2026-72740?

Critical severity, with a CVSS score of 9.9, published 10 August 2026.

Is there a fix for CVE-2026-72740?

A patch was published on 2026-07-19: Fix committed and released in version 0.29.13 on 2026-07-21 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-72740 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-72740?

Check whether you run Dokploy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-72740: Dokploy OS command injection in git clone deployment

CVE-2026-72740 · Severity: critical · CVSS 9.9 · Published 2026-08-10

Dokploy is a self-hosted platform-as-a-service tool that lets organizations deploy and manage applications. An authenticated attacker with deployment permissions can inject arbitrary shell commands during application deployment by manipulating git repository URLs, allowing them to execute code with the privileges of the Dokploy server process. This could lead to complete compromise of the hosting infrastructure and deployed applications.

Technologies: Dokploy. Vendors: Dokploy.

Quick answers

Is CVE-2026-72740 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-72740 being exploited in the wild.
How severe is CVE-2026-72740?: Critical severity, with a CVSS score of 9.9, published 10 August 2026.
Which products and versions are affected?: Dokploy before 0.29.13.
Is there a fix for CVE-2026-72740?: A patch was published on 2026-07-19: Fix committed and released in version 0.29.13 on 2026-07-21 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-72740 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-72740?: Check whether you run Dokploy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an OS command injection (CWE-78) in packages/server/src/utils/providers/git.ts. User-controlled input (customGitUrl and related git fields) is interpolated directly into shell commands executed via ssh-keyscan and git clone without proper quoting or escaping. An authenticated service member with deployment permissions can craft a malicious custom git URL containing shell metacharacters to break out of the intended command context and execute arbitrary commands on the Dokploy host. The fix, released in v0.29.13, implements shell-quote escaping on all user-controlled git-related fields before command interpolation (defense at the sink), covering all code paths including compose branch deployments.

Affected products

Dokploy Dokploy before 0.29.13

Timeline

2026-08-10: disclosed: CVE-2026-72740 published on NVD
2026-07-19: patched: Fix committed and released in version 0.29.13 on 2026-07-21

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.