CVE-2026-72739

MediumCVSS 6.5/10Last modified Sep 8, 2026

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the createCommand() function constructs shell commands by interpolating compose service names and configuration into bash command strings. When a compose with a maliciously crafted name or service definition is deployed, the shell metacharacters are interpreted as command separators, allowing arbitrary command execution on the Docker host. This vulnerability is fixed in 0.29.13.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Aug 10, 2026
Last modified
Sep 8, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-727409.9Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, packages/server/src/utils/providers/git.ts parses the user-CVE-2026-727418.1Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticated attackers to acceCVE-2026-727428.6DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence ovCVE-2026-727435.4SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that CVE-2026-727446.2Nuxt versions >= 4.4.7 and < 4.5.1, and >= 3.21.7 and < 3.21.10, contain an information disclosure vulnerability in the development server'sCVE-2026-727477.2AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that peCVE-2026-727489.1AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint that allows remote attackeCVE-2026-727496.5n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The node assigns output CVE-2026-727508.8n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interpCVE-2026-727515.1CTI-Transmute is affected by a stored cross-site scripting (XSS) vulnerability in the conversion graph used to visualise converted MISP and CVE-2026-727596.9In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a histoCVE-2026-727605.3Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated u
CVE-2026-72739: Medium severity, CVSS 6.5 | Vulnix