External risk intelligence

Dokploy Command Injection in Backup Restore Pipeline

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-72878

Dokploy is a self-hosted Platform as a Service (PaaS) designed to manage deployments, often functioning as a web-based dashboard or management console. Such platforms are typically deployed as internet-facing services to facilitate remote management and continuous integration pipelines, placing the administrative interface in a position where it is commonly accessible from the internet.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Dokploy, a self-hosted platform for managing deployments, allows authenticated administrators to execute arbitrary operating system commands on the host machine. This is due to the system improperly handling user-controlled database fields when constructing shell commands. The primary concern is confirming relevance and exposure given the nature of the affected technology.

Unauthenticated admin can run commands on host.
Affects self-hosted deployment management platforms.
Confirm if your Dokploy instances are affected.

Attack Path

How an attacker could exploit the issue

An attacker with administrative access to Dokploy can abuse the backup and restore functionality to execute arbitrary operating system commands on the host running Dokploy. This occurs because user-controlled database fields are directly inserted into shell commands without proper sanitization, allowing for command injection. Successful exploitation could lead to the compromise of the host system.

Authenticated admin access required.
Inject commands via database fields.
Host system compromise risk.

Live Threat

Current exploitation, exposure, and threat context

An authenticated admin or owner of Dokploy could inject arbitrary operating system commands. This could occur when the backup and restore pipeline directly uses user-controlled database fields to construct shell commands, which are then executed on the host machine running Dokploy.

Arbitrary OS commands on host.
User data interpolated into commands.
Compromised host system integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

The self-hosted nature of Dokploy suggests that platform or infrastructure teams are likely responsible for its management and security. The first practical step is to locate all Dokploy instances, assess their network reachability and business criticality, and identify the accountable owner. Remediation planning should then prioritize based on these findings to mitigate risk effectively.

Platform/Infrastructure teams own resolution.
Verify Dokploy instance reachability and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dokploy?

Dokploy is an open-source, self-hosted Platform as a Service (PaaS). It provides a web-based dashboard that helps developers manage application deployments, databases, and CI/CD pipelines on their own infrastructure, acting as a centralized control plane for various server environments.

What does CWE-78 mean for CVE-2026-72878?

CWE-78 refers to Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. In CVE-2026-72878, this means Dokploy fails to clean user input before using it to build system commands. By embedding malicious text into database fields, a user can trick the application into executing unauthorized instructions directly on the underlying server's operating system.

How does the command injection get triggered?

The vulnerability is triggered during the backup and restore process. When the system executes shell commands to process database fields, it incorrectly incorporates user-provided content. Note that this requires administrative credentials; an unauthenticated user cannot trigger this execution path.

Is my Dokploy instance at risk?

According to Halo Surface Signal, Dokploy is often deployed as an internet-facing service for remote management, which increases the likelihood of external accessibility. If your instance is reachable from the internet and managed by administrative accounts, it should be considered a priority for review.

How do I secure my Dokploy environment?

The first step is to identify all running instances of Dokploy within your infrastructure and confirm their current version. Since this issue is resolved in version 0.29.13, you should plan to update any installations older than this release immediately to eliminate the command injection risk.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.