CVE-2026-72885

Impact

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, dockerContextPath accepted by apps/dokploy/components/dashboard/application/build/show.tsx flows through getDockerContextPath in packages/server/src/utils/filesystem/directory.ts into the unquoted cd command in packages/server/src/utils/builders/docker-file.ts before execution by execAsync, allowing an authenticated application editor to execute arbitrary commands on the Dokploy host. This issue is fixed in version 0.29.13.

Affected packages

This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.

Weakness classification

References

• NVD record
• CVE.org record
• https://github.com/Dokploy/dokploy/commit/cba0b253c7de4157dd932de7f16a2ad247c7cee9
• https://github.com/Dokploy/dokploy/pull/4860
• https://github.com/Dokploy/dokploy/releases/tag/v0.29.13
• https://github.com/Dokploy/dokploy/security/advisories/GHSA-qjrc-g63x-qhp9
• https://github.com/Dokploy/dokploy/security/advisories/GHSA-qjrc-g63x-qhp9