External risk intelligence

Dokploy Backup Command Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-72738

Dokploy is a self-hostable Platform as a Service (PaaS) designed to manage application deployments. Such systems typically function as centralized web-based management consoles or control planes, which are commonly exposed or accessible to developers and administrators over the network to facilitate remote management and deployment tasks.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Dokploy, a self-hostable Platform as a Service, that could allow an authenticated user to execute arbitrary commands on the host system. This issue stems from how the backup feature handles user-provided input, potentially enabling unauthorized code execution if the system is not updated.

Authenticated users can run unauthorized commands.
Confirms Dokploy's critical function in deployment workflows.
Prioritize confirming Dokploy's relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker with read access to backups can exploit this vulnerability by sending a specially crafted request to the backup listing endpoint. This request manipulates a search parameter, which is then used in a command executed on the server, potentially leading to arbitrary command execution on the Dokploy host.

Authenticated user with backup read permission.
Manipulated search parameter in backup list request.
Arbitrary command execution on the host.

Live Threat

Current exploitation, exposure, and threat context

An authenticated user with backup read permissions could execute arbitrary commands on the Dokploy host. This could occur when the `backup.listBackupFiles` tRPC endpoint processes a search parameter, interpolating it into an `rclone lsjson` command executed via `child_process.exec()`.

Host system commands.
Via a specific API endpoint.
Unauthorized command execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

System owners and infrastructure teams are likely responsible for addressing this vulnerability in Dokploy, a self-hostable PaaS. The first practical step is to identify all Dokploy instances, confirm their network reachability and business criticality, and then assign ownership to the accountable team for remediation planning.

Own the issue based on asset accountability.
Verify Dokploy instance exposure and criticality.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dokploy?

Dokploy is a self-hostable Platform as a Service (PaaS) used to streamline application deployments. Developers typically use it as a centralized management console to handle infrastructure, monitor containers, and manage backup processes across their environments.

What is the vulnerability in CVE-2026-72738?

This CVE involves a vulnerability known as OS Command Injection (CWE-78). In simple terms, the software takes input from a user and incorrectly inserts it into a system command. Because the application does not properly sanitize this input, an attacker can manipulate the command to execute unauthorized instructions directly on the host server.

How does an attacker trigger this command injection?

An attacker triggers this by sending a specially crafted request to the backup.listBackupFiles API endpoint. The vulnerability relies on manipulating a search parameter used by the system to list files. It is important to note that the vulnerability is not triggered by public traffic alone; the attacker must have legitimate backup:read permissions to interact with this specific endpoint.

Is my Dokploy instance at risk?

According to Halo Surface Signal, Dokploy instances function as control planes that are frequently accessible over the network to allow remote management. If your instance is reachable via the network, it is classified as external. You should consider any Dokploy instance where users have backup:read permissions as a potential target for this vulnerability.

What should I do if I run Dokploy?

The most effective way to secure your environment is to update your software to version 0.29.13 or later. Before patching, perform an inventory of all Dokploy instances in your infrastructure to verify which ones are active and reachable. Once identified, assign ownership to the appropriate team to ensure the update is applied immediately.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.