What is CVE-2026-72872?
CVE-2026-72872 is a critical command injection vulnerability in the Dokploy PaaS platform. In versions before 0.29.13, unvalidated `bitbucketOwner` and `bitbucketRepository` inputs from `application.saveBitbucketProvider` are interpolated into a `git clone` command in `cloneBitbucketRepository`. Authenticated users can exploit this to execute arbitrary commands; immediate update to the latest version is recommended.
Azərbaycanca: CVE-2026-72872 Dokploy PaaS platformasında aşkarlanan kritik boşluqdur. 0.29.13 öncəsi versiyalarda `application.saveBitbucketProvider` vasitəsilə doğrulanmamış `bitbucketOwner` və `bitbucketRepository` dəyərləri `cloneBitbucketRepository` funksiyasında git clone əmrinə daxil edilir. Bu, autentifikasiyalı istifadəçiyə `Command Injection` həyata keçirməyə imkan verir; dərhal son versiyaya yeniləmə tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-77
FAQ2
Is authentication required to exploit CVE-2026-72872?
Yes, this vulnerability can be exploited by an authenticated user.
During which operation does CVE-2026-72872 lead to Command Injection?
Command Injection occurs when unvalidated inputs from `application.saveBitbucketProvider` are interpolated into a `git clone` command within the `cloneBitbucketRepository` function.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.