# CVE-2026-72862: Dokploy OS command injection in database service deployments

Source: https://junglewise.ai/threats/cve-2026-72862-dokploy-os-command-injection-in-database-service-deployments  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-72862 · Severity: critical · CVSS 9.9 · Published 2026-08-10

Dokploy is a self-hosted platform-as-a-service tool that allows teams to deploy applications and services. Prior to version 0.29.13, the database deployment functions (PostgreSQL, MySQL, MariaDB, MongoDB, Redis, and LibSQL) were vulnerable to command injection because user-supplied Docker image names were not properly escaped before being passed to shell commands executed on remote servers. An attacker with platform access could inject arbitrary shell commands through a crafted Docker image name, potentially compromising the entire deployment infrastructure and gaining unauthorized access to deployed databases and applications.

Technologies: [Dokploy](https://junglewise.ai/threats/technologies/dokploy). Vendors: [Dokploy](https://junglewise.ai/threats/vendors/dokploy).

## Quick answers

**Is CVE-2026-72862 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-72862 being exploited in the wild.

**How severe is CVE-2026-72862?** Critical severity, with a CVSS score of 9.9, published 10 August 2026.

**Which products and versions are affected?** Dokploy before 0.29.13.

**Is there a fix for CVE-2026-72862?** A patch was published on 2026-07-19: Fix released in version 0.29.13 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-72862 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-72862?** Check whether you run Dokploy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an OS command injection vulnerability (CWE-78) in the database service deployment functions for Dokploy. The vulnerable code in mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts passed user-controlled dockerImage field values directly into shell commands via string interpolation (docker pull ${dockerImage}) without proper escaping or quoting, then executed these commands on remote servers using execAsyncRemote (SSH). An authenticated attacker with permissions to deploy database services can exploit this by providing a malicious Docker image name containing shell metacharacters (e.g., '; rm -rf /') to execute arbitrary commands on the remote server. The fix, released in version 0.29.13, applies proper shell escaping using the shell-quote library to safely quote the dockerImage parameter before shell execution.

## Affected products

- Dokploy Dokploy before 0.29.13

## Timeline

- 2026-08-10: disclosed
- 2026-07-19: patched: Fix released in version 0.29.13

## References

- [https://github.com/Dokploy/dokploy/commit/b24202e69b244f0ece8d2f56e99cad9bb5e1a248](https://github.com/Dokploy/dokploy/commit/b24202e69b244f0ece8d2f56e99cad9bb5e1a248)
- [https://github.com/Dokploy/dokploy/releases/tag/v0.29.13](https://github.com/Dokploy/dokploy/releases/tag/v0.29.13)

## Related threats

- [Dokploy missing ownership check in application monitoring](https://junglewise.ai/threats/cve-2026-127212-dokploy-before-0-31-1-contains-a-missing-ownership-check)
- [Dokploy authorization bypass in application management](https://junglewise.ai/threats/cve-2026-116068-dokploy-through-0-30-10-contains-an-authorization-bypass)
- [Dokploy cross-organization authorization bypass in port router](https://junglewise.ai/threats/cve-2026-111331-dokploy-through-0-30-8-contains-a-cross-organization)
- [Dokploy OS command injection in patch repository read](https://junglewise.ai/threats/cve-2026-93425-dokploy-is-a-free-self-hostable-platform-as-a-service-paas-prior)
- [Dokploy credential disclosure in provider APIs](https://junglewise.ai/threats/cve-2026-86059-dokploy-is-a-free-self-hostable-platform-as-a-service-paas-prior)