External risk intelligence

Dokploy Remote Code Execution via Crafted Database Name

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-72869

Dokploy is a self-hostable Platform as a Service (PaaS) designed to manage application deployments. Such systems are typically deployed as internet-facing management portals or gateways to facilitate remote administration and deployment workflows, making the interface reachable from the network.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in Dokploy, a self-hostable Platform as a Service, that could allow an authenticated user to execute arbitrary commands on the host system with high privileges. This occurs because a parameter used in restoring backups is not properly validated, leading to the execution of dangerous commands within the Docker environment. This issue is a significant concern for organizations using Dokploy for deployment management.

Allows unauthorized command execution.
Affects privileged host system access.
Confirm Dokploy usage and update it.

Attack Path

How an attacker could exploit the issue

An attacker can initiate an attack by leveraging an authenticated user account that possesses backup restoration privileges. This user can then provide a specially crafted database name during the restore process. The Dokploy application's handling of this input allows for shell commands to be embedded and executed, ultimately enabling arbitrary command execution within the Docker-privileged host environment.

Authenticated user with backup restore permission.
Crafted database name during backup restore.
Arbitrary command execution in host context.

Live Threat

Current exploitation, exposure, and threat context

An authenticated user with backup restoration privileges could execute arbitrary commands on the host system. This occurs when a specially crafted database name is provided during the backup restore process, which is then interpreted and executed by the underlying shell. The vulnerability specifically impacts the Dokploy PaaS when it is self-hosted and the backup restore functionality is utilized with a malicious input.

Arbitrary command execution on host.
Malicious input during backup restore.
Compromise of the hosting environment.

Operational Fix

Recommended remediation, mitigation, and detection steps

The self-hostable PaaS Dokploy, used for application deployment, presents a critical vulnerability that allows authenticated users with restore permissions to execute arbitrary commands on the host system. This impacts the infrastructure and platform teams responsible for managing the Dokploy instance. The immediate practical step is to identify all Dokploy instances, assess their business criticality and network reachability, and determine the accountable owner for remediation.

Infrastructure/Platform teams own the issue.
Verify Dokploy instance reachability and criticality.
Plan and coordinate vendor-supported upgrades.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dokploy?

Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies how developers manage, deploy, and monitor applications. It acts as a central management dashboard, often running on a server to handle automated deployment workflows and infrastructure tasks for various databases and web services.

What is the vulnerability in CVE-2026-72869?

This vulnerability involves Improper Neutralization of Special Elements used in an OS Command (CWE-78), commonly known as OS Command Injection. In Dokploy, the system fails to sanitize the database name during a backup restoration process. Because the application passes this name directly into a system shell, an attacker can append malicious commands that the server executes with high privileges.

How does an attacker trigger this command execution?

An attacker must have an authenticated user account with specific permissions to restore backups. By providing a specially crafted string as the database name during this process, they manipulate the command line inputs. Merely viewing or browsing the interface does not trigger the bug; the restoration workflow must be actively initiated with the malicious input.

Is my Dokploy instance at risk?

According to Halo Surface Signal, Dokploy is designed as a management portal, which often makes it an internet-facing gateway for remote administration. If your instance is reachable from the network, it is at higher risk. You should prioritize assessment if your setup allows external access, as this increases the potential surface for authenticated attackers to reach the restoration functionality.

What should I do to secure my Dokploy installation?

The primary response is to update your Dokploy instance to version 0.29.13 or later, which contains the fix for the input handling issue. Platform and infrastructure teams should audit user roles to ensure only trusted accounts hold backup restoration privileges, then coordinate the update across all self-hosted environments immediately.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.