Vulnerability · Published Aug 10, 2026 · Assigned by GitHub_M

CVE-2026-72872Dokploy: OS Command Injection via Bitbucket `owner`/`repository` in `git clone`

Critical 9.9

In plain English

A critical-severity OS command injection in dokploy from Dokploy. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)0.7%top 48.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, application.saveBitbucketProvider stores bitbucketOwner and bitbucketRepository without validation and cloneBitbucketRepository in packages/server/src/utils/providers/bitbucket.ts interpolates those values into git clone commands executed through execAsync or execAsyncRemote, allowing a member with service deployment permission to execute arbitrary operating system commands on the Dokploy host or target server. This issue is fixed in version 0.29.13.

Affected products (as reported)

Vendor	Product	Versions
Dokploy	dokploy	< 0.29.13

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/Dokploy/dokploy/security/advisories/GHSA-grrj-6xrh-j6vp x_refsource_CONFIRM
https://github.com/Dokploy/dokploy/pull/4855 x_refsource_MISC
https://github.com/Dokploy/dokploy/commit/47347ab885b0ad1f5d0ef0e5e74bbba35c7f93bc x_refsource_MISC
https://github.com/Dokploy/dokploy/releases/tag/v0.29.13 x_refsource_MISC