CVE-2026-72881 Dokploy: Command Injection via database credentials in backup/restore commands
An authenticated administrator can execute arbitrary commands via crafted database credentials in backup/restore operations, exposing data and enabling container escape.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-72881?
CVE-2026-72881 is a medium-severity command injection vulnerability in dokploy, published on 10 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, database backup and restore command builders in packages/server/src/utils/backups/utils.ts and packages/server/src/utils/restore/utils.ts interpolate database names, usernames, and passwords into nested shell command strings passed to child_process.exec(). An authenticated administrator with permission to create databases and configure backups can use crafted database configuration fields to execute arbitrary commands inside PostgreSQL, MariaDB, MySQL, MongoDB, or LibSQL containers, exposing database data and credentials and potentially enabling escape when a container is overprivileged. This issue is fixed in version 0.29.13.
Weakness: CWE-78
Which versions are affected by CVE-2026-72881?
How do I fix CVE-2026-72881?
No fix has been published for CVE-2026-72881 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-72881 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-72881 exists.
Sources
Also known as GHSA-qc73-mp78-4833.