Dokploy Flaw Lets Authenticated Users Execute Commands as Root

Dokploy has a critical operating-system command-injection vulnerability, tracked as CVE-2026-72878 and vulnerability note VU#280377. The flaw affects self-hosted Platform-as-a-Service environments and allows authenticated users to run shell commands as root. It is present in tRPC procedures used to create and restore database backups, where user-controlled values such as database names and the `backupFile` parameter are inserted directly into shell commands. Validation only checks that these values are non-empty strings, without filtering shell metacharacters, before `/bin/bash` executes them.

The issue affects Dokploy deployments using PostgreSQL, MySQL, MariaDB, MongoDB or LibSQL. Security analysts confirmed exploitation against versions 0.29.8 and 0.29.11, as well as commit `24b02f5` on the canary branch. The article says the exploit is reliable, but active exploitation in the wild has not been confirmed.

Because backup processes run with root privileges by default, successful exploitation could allow attackers to read or overwrite the host filesystem and obtain credentials or secrets belonging to other tenants. Administrators should upgrade to Dokploy 0.29.13 or later. Where an immediate upgrade is not possible, the recommended interim measure is to disable default backup permissions and limit backup functions to highly trusted administrators.