CVE-2026-72882CWE-78command-injection

CVE-2026-72882

Critical · published August 11, 2026

CVSS v3.1
9.9
EPSS
1%
Percentile
43.2
In the wild
Unconfirmed
What it is

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, an authenticated user who can create or update file mounts for a service can inject shell metacharacters into filePath, causing Dokploy to execute attacker-controlled commands on the configured remote managed server over SSH. In the default deployment model, this yields direct remote host RCE from the web interface.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00518 · 43.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-08-11T00:17Z
References (2)
https://github.com/Dokploy/dokploy/security/advisories/GHSA-qcf5-jjjp-7794 · [email protected]https://github.com/Dokploy/dokploy/security/advisories/GHSA-qcf5-jjjp-7794 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 10 AUG 19:27Z
    Dokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed servers
    cvelistv5