Vulnerability · Published Aug 10, 2026 · Assigned by GitHub_M

CVE-2026-72882Dokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed servers

Critical 9.9

In plain English

A critical-severity OS command injection in dokploy from Dokploy. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)0.5%top 55.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, an authenticated user who can create or update file mounts for a service can inject shell metacharacters into filePath, causing Dokploy to execute attacker-controlled commands on the configured remote managed server over SSH. In the default deployment model, this yields direct remote host RCE from the web interface.

Affected products (as reported)

Vendor	Product	Versions
Dokploy	dokploy	<= 0.28.8

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/Dokploy/dokploy/security/advisories/GHSA-qcf5-jjjp-7794 x_refsource_CONFIRM