External risk intelligence

Dokploy Command Injection Vulnerability Affects Self-Hosted PaaS

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-72865

Dokploy is a self-hostable Platform as a Service (PaaS) designed to manage containerized deployments. Such platforms are typically deployed as internet-facing management portals to facilitate remote application deployment and monitoring, making the administrative interface and its associated services commonly reachable from the network edge.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Dokploy, a self-hostable platform for managing deployments, allows authenticated users to execute arbitrary commands on the host system. This could potentially impact the integrity and availability of deployed applications and the underlying infrastructure. The main concern is confirming relevance and exposure to our environment.

Unvalidated input allows command execution.
Critical systems could be compromised remotely.
Assess Dokploy's presence and impact.

Attack Path

How an attacker could exploit the issue

An attacker with write and deploy permissions on Dokploy can exploit this vulnerability. They would start by crafting a malicious path and then trigger a deployment operation. This allows them to execute arbitrary operating-system commands on the host system, with the privileges of Docker.

Authenticated user with write/deploy permissions.
Trigger compose deploy or startCompose.
Arbitrary OS command execution.

Live Threat

Current exploitation, exposure, and threat context

An authenticated user with specific permissions could execute arbitrary operating system commands on the Dokploy host. This could occur when the system processes a crafted compose path during deployment operations, potentially affecting the integrity and availability of the host environment.

Host operating system commands could be executed.
Malicious commands could be supplied via compose path.
Compromise of the underlying host system.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Dokploy PaaS platform's infrastructure and platform teams are likely responsible for addressing this vulnerability. The first practical step is to identify all Dokploy hosts, determine their network exposure, and confirm critical business functions they support. Once discovered, engage the accountable owner to plan remediation, prioritizing hosts that are externally accessible or critical to operations.

Platform and infrastructure teams own remediation.
Verify Dokploy instance reachability and criticality.
Plan updates or compensating controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dokploy?

Dokploy is an open-source, self-hosted Platform as a Service (PaaS). It provides a management interface that simplifies how teams deploy, manage, and monitor containerized applications, similar to how one might use a cloud provider's managed container service, but hosted on your own infrastructure.

How does CVE-2026-72865 work?

This vulnerability is classified as CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection). It occurs because Dokploy does not properly validate the file paths used for deployment configurations. An attacker can inject malicious commands into these paths, which the system then executes with the high privileges of the underlying Docker host.

Do I need to worry if I am not logged into Dokploy?

The vulnerability requires an attacker to have a valid account with specific 'compose write' and 'deploy' permissions to trigger the flaw. Simply browsing the interface without these credentials does not allow an attacker to exploit this issue. However, if an account is compromised, the vulnerability provides a path to escalate control to the host operating system.

Why is this CVE considered relevant for network-connected Dokploy instances?

Halo Surface Signal identifies Dokploy as a platform typically deployed as an internet-facing management portal. Because these interfaces are often reachable from the network edge to allow for remote management, any vulnerability that enables command execution poses a higher risk, as it potentially grants an attacker access to the underlying infrastructure from the network.

When should I update Dokploy to fix this?

You should update to version 0.29.13 or later immediately. As a first step, perform an inventory of all your Dokploy instances to identify which ones are currently running older, vulnerable versions. Prioritize updating those that are accessible via the internet or handle critical business services to eliminate the command injection path.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.