CVE-2026-72885None▾ Sunlit

Dokploy is a free, self-hostable Platform as a Service (PaaS)

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0.2 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Aug 10, 2026

Updated

Sep 8, 2026

CVSS

—

Vendor

—

Product

—

CWE

CWE-78

Depth score

3 · Minimal

EPSS

0.82% · p57

Platforms

—

Source

NVD

Vector

—

EPSS history

Exploit-prediction probability, daily snapshots since Sep 8.

0.6% → 0.8%▲ 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 46 days

Aug 10, 2026Published
Disclosed via NVD
Sep 8, 2026Record revised
Last analysed / modified upstream
Sep 8, 2026EPSS first tracked
0.6%
Sep 25, 2026EPSS peak
0.6% → 0.8%

CWE-78 #nvd

Full technical detail▾

Overview

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, dockerContextPath accepted by apps/dokploy/components/dashboard/application/build/show.tsx flows through getDockerContextPath in packages/server/src/utils/filesystem/directory.ts into the unquoted cd command in packages/server/src/utils/builders/docker-file.ts before execution by execAsync, allowing an authenticated application editor to execute arbitrary commands on the Dokploy host. This issue is fixed in version 0.29.13.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed