What is CVE-2026-72870?
This vulnerability in Dokploy PaaS allows an authenticated user to inject arbitrary shell commands via the `dockerImage` parameter in the `buildRemoteDocker()` function, due to improper input sanitization before executing `docker pull`. Attackers can gain system-level access. Upgrading to version 0.29.13 is recommended.
Azərbaycanca: Bu boşluq Dokploy PaaS platformasında aşkarlanıb və `buildRemoteDocker()` funksiyası vasitəsilə autentifikasiya olunmuş istifadəçiyə `docker pull` əmrində `dockerImage` parametrini manipulyasiya edərək ixtiyari shell əmrləri icra etməyə imkan verir. Hücumçu sistem səviyyəsində icazələr əldə edə bilər. 0.29.13 versiyasına yeniləmə tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-77
FAQ2
Through which operation can an authenticated user execute arbitrary shell commands on the Dokploy PaaS platform?
An authenticated user can execute arbitrary shell commands by manipulating the `dockerImage` parameter in the `docker pull` command within the `buildRemoteDocker()` function.
Which version is recommended to upgrade to in order to protect against CVE-2026-72870?
Upgrading the Dokploy platform to version 0.29.13 is recommended.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.