External risk intelligence

Dokploy PaaS Command Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-72867

Dokploy is a Platform as a Service (PaaS) designed for self-hosting and managing deployments. As a central management interface for application hosting, such services are commonly deployed as internet-facing web applications or management portals to facilitate remote access and deployment operations.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Dokploy, a self-hostable Platform as a Service, that could allow an authenticated user to execute arbitrary commands on the host system. The issue stems from incomplete validation of custom branch fields, which are later used in server-side Git commands.

Command execution risk in self-hosted PaaS.
Potential for unauthorized system control.
Confirm relevance and exposure of Dokploy instances.

Attack Path

How an attacker could exploit the issue

An attacker with low-level authenticated access can first inject a malicious branch name into Dokploy's configuration. When a user initiates a deployment, Dokploy uses this stored, unsanitized branch name in system commands to interact with Git. This process can be manipulated to execute arbitrary commands on the host system.

Requires authenticated access.
Triggers deployment action.
Arbitrary command execution risk.

Live Threat

Current exploitation, exposure, and threat context

A low-privileged authenticated user could execute arbitrary commands on the host system by providing a malicious branch name during a deployment request. This vulnerability could impact the confidentiality, integrity, and availability of the host system.

Host system commands could be executed.
Malicious branch names are accepted.
Arbitrary host command execution is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Platform as a Service (PaaS) deployments like Dokploy are typically managed by platform or infrastructure teams, with potential oversight from application owners if they utilize the PaaS for their deployments. The first step is to identify all instances of Dokploy, assess their exposure and criticality, and confirm the accountable owner for each. Planning remediation should then be based on this risk assessment, considering vendor coordination for patches and potential temporary risk reduction measures.

Platform/Infrastructure teams own the issue.
Verify Dokploy instances and exposure.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dokploy?

Dokploy is a free, self-hostable Platform as a Service (PaaS). It functions as a central management interface that developers use to automate, deploy, and manage applications across various environments, simplifying the process of hosting code from platforms like GitHub, GitLab, and Bitbucket.

How does CVE-2026-72867 cause a system security risk?

This vulnerability is primarily a weakness in input validation (CWE-20) and improper neutralization of special elements used in an OS command (CWE-78). Because the system does not properly clean specific branch name fields, it allows an attacker to inject malicious commands into the Git operations the software performs behind the scenes, leading to unauthorized command execution on the host.

When does this vulnerability trigger?

The issue occurs when an authenticated user saves a malicious branch name in a project configuration and then initiates a deployment. It is not triggered by simply having an account; the malicious payload must be stored and subsequently processed by the application's internal Git command utilities during the deploy action.

Is my Dokploy instance at risk?

Halo Surface Signal indicates that Dokploy is often deployed as an internet-facing management portal to allow for remote application hosting and configuration. If your instance is accessible over the internet, it is more likely to be reached by unauthorized users who could attempt to leverage their authenticated access to exploit this flaw.

How do I secure my environment against this flaw?

The primary resolution is to update your Dokploy installation to version 0.29.13 or later, which contains the necessary server-side validation to block malicious branch inputs. Infrastructure teams should prioritize identifying all active Dokploy instances and verifying their current version to ensure they are no longer vulnerable.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.