Vulnerability · Published Aug 10, 2026 · Assigned by GitHub_M

CVE-2026-72735Dokploy: Command injection in writeTraefikConfigRemote via shell interpolation of unescaped YAML in SSH remote execution

Critical 9.9

In plain English

A critical-severity command injection in dokploy from Dokploy. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)0.9%top 39.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed through execAsyncRemote. Single quotes in redirect regex and replacement fields, basic authentication usernames, domain host values, or middleware configuration can terminate the shell quoting and execute arbitrary commands on managed remote servers with the configured SSH user's privileges. This vulnerability is caused by an incomplete fix for CVE-2026-45630. This issue is fixed in version 0.29.13.

Affected products (as reported)

Vendor	Product	Versions
Dokploy	dokploy	< 0.29.13

Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/Dokploy/dokploy/security/advisories/GHSA-478p-cx3j-hghc x_refsource_CONFIRM
https://github.com/Dokploy/dokploy/commit/92310ddb143c8e67ca95eb7db661838a76579f2e x_refsource_MISC
https://github.com/Dokploy/dokploy/releases/tag/v0.29.13 x_refsource_MISC