DOKPLOY contains a critical operating-system command-injection vulnerability, tracked as VU#280377 and CVE-2026-72878. The flaw affects self-hosted Platform as a Service environments and allows authenticated users to execute shell commands as root. This could give an attacker control of the host, including the ability to read or overwrite files and obtain credentials or secrets belonging to other tenants on shared infrastructure.
The issue lies in tRPC procedures used to create and restore database backups. Dokploy inserts user-controlled values, including database names and the `backupFile` parameter, directly into shell command strings. Validation checks only that these values are non-empty strings; it does not remove shell metacharacters before commands are passed to `/bin/bash`. The article says researchers confirmed the exploit is reliable, but active exploitation in the wild has not been confirmed.
All five supported databases—PostgreSQL, MySQL, MariaDB, MongoDB and LibSQL—are affected. Exploitation was confirmed against versions 0.29.8 and 0.29.11, and commit `24b02f5` on the canary branch.
Administrators should upgrade to Dokploy 0.29.13 or later. Where an immediate upgrade is not possible, the recommended interim measure is to disable default backup permissions and restrict backup functions to highly trusted administrators.