What is CVE-2026-72868?
CVE-2026-72868 is a command injection vulnerability in the self-hostable PaaS platform Dokploy. Prior to version 0.29.13, input fields such as accessKey and secretAccessKey from the testConnection feature are interpolated directly into an 'rclone ls' shell command, potentially allowing remote code execution. Users should immediately upgrade to version 0.29.13 or later to mitigate the risk.
Azərbaycanca: CVE-2026-72868 Dokploy öz-özünə host edilən PaaS platformasında aşkarlanmış əmr inyeksiya zəifliyidir. 0.29.13 versiyasından əvvəlki versiyalarda "destination.testConnection" funksiyası vasitəsilə ötürülən giriş açarları və digər parametrlər birbaşa "rclone ls" əmrinə daxil edilir ki, bu da hücumçuya uzaqdan əmr icra etməyə imkan verə bilər. Təhlükəsizlik üçün platformanı dərhal 0.29.13 və ya daha yuxarı versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-77
FAQ2
Which versions of Dokploy are affected by CVE-2026-72868?
All versions of Dokploy prior to 0.29.13 are affected by CVE-2026-72868.
How can I mitigate CVE-2026-72868?
To mitigate this vulnerability, you should immediately upgrade your Dokploy instance to version 0.29.13 or later.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.