Executive brief
Dokploy is a self-hosted platform-as-a-service tool that lets organizations deploy and manage applications. An authenticated attacker with deployment permissions can inject arbitrary shell commands during application deployment by manipulating git repository URLs, allowing them to execute code with the privileges of the Dokploy server process. This could lead to complete compromise of the hosting infrastructure and deployed applications.
Technical details
The vulnerability is an OS command injection (CWE-78) in packages/server/src/utils/providers/git.ts. User-controlled input (customGitUrl and related git fields) is interpolated directly into shell commands executed via ssh-keyscan and git clone without proper quoting or escaping. An authenticated service member with deployment permissions can craft a malicious custom git URL containing shell metacharacters to break out of the intended command context and execute arbitrary commands on the Dokploy host. The fix, released in v0.29.13, implements shell-quote escaping on all user-controlled git-related fields before command interpolation (defense at the sink), covering all code paths including compose branch deployments.
Affected products
- Dokploy Dokploy before 0.29.13
Timeline
- 2026-08-10: disclosed: CVE-2026-72740 published on NVD
- 2026-07-19: patched: Fix committed and released in version 0.29.13 on 2026-07-21