External risk intelligence

Dokploy Command Injection Vulnerability in Restore Functionality

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-72733

Dokploy is a self-hostable Platform as a Service (PaaS) designed to manage application deployments and infrastructure. As a centralized management platform for web applications and services, these tools are typically deployed as internet-facing portals to enable remote management and administrative access.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Dokploy, a platform for managing application deployments. The issue allows an authenticated user to inject operating-system commands, potentially impacting the host environment where Dokploy is running. The main concern is confirming relevance and exposure.

Allows command injection in a deployment platform.
Affects systems managing application deployments.
Confirm relevance and exposure of this platform.

Attack Path

How an attacker could exploit the issue

An attacker with backup-restore permissions can inject commands into the Dokploy host system. This is possible because the backup restoration process improperly handles user-provided database names and backup file names, allowing them to be interpreted as shell commands. This could lead to complete host compromise.

Authenticated member with backup-restore access.
Injecting shell commands via database name or backup file fields.
Command execution on the Dokploy host.

Live Threat

Current exploitation, exposure, and threat context

An authenticated user with backup-restore permissions could inject operating-system commands into the Dokploy host environment. This could occur through the backup restore functionality when building database restore shell pipelines, even if a valid database or backup file does not exist.

Host system commands could be executed.
Malicious commands injected via backup restore.
Full system compromise may be possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Platform owners or infrastructure teams are likely responsible for addressing this critical vulnerability in Dokploy, a self-hosted PaaS. The immediate first step is to identify all Dokploy instances within your environment, confirm their external reachability and business criticality, and then locate the specific team or individual accountable for each instance to initiate a risk-based remediation plan.

Platform owners should take immediate action.
Verify Dokploy instance reachability and criticality.
Plan risk-based remediation and coordinate upgrades.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dokploy?

Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies managing application deployments and infrastructure. Developers use it to automate the setup and maintenance of web applications and services, often acting as a centralized administrative dashboard for their hosting environments.

How does CVE-2026-72733 cause command injection?

This vulnerability, classified as CWE-78 (OS Command Injection), occurs when the system improperly incorporates user-supplied data into shell commands. Specifically, the backup restoration feature takes input from database name or backup file fields and passes it directly to the system shell without sanitization, allowing an attacker to insert and execute unauthorized OS-level commands.

When is this vulnerability triggered?

The issue is triggered when an authenticated user with backup-restore permissions interacts with the restore subscription function. Notably, an attacker does not need a valid database container or a real backup file to succeed; the system processes the malicious command injection regardless of whether those backend resources actually exist.

Is my Dokploy instance at risk?

According to Halo Surface Signal, Dokploy is frequently deployed as an internet-facing portal to facilitate remote management, which increases its accessibility to potential attackers. If your instance is reachable over the network, you should prioritize investigating this vulnerability, especially if you have multiple users with backup-restore access.

How should I respond to this security update?

The primary response is to update your Dokploy installation to version 0.29.13 or later, which contains the necessary fixes. Before updating, identify all running instances in your environment, confirm their network accessibility, and coordinate with the teams responsible for managing those specific deployments to schedule the upgrade.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.