LOWVulnerability

CVE-2026-72879

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.8, the getRegistryCommands() function in packages/server/src/utils/cluster/upload.ts interpolates registry.password and registry.registryUrl directly into a shell command without escaping. An authenticated user with project access can configure malicious registry credentials and trigger a swarm deployment to execute arbitrary OS commands on the Dokploy server, read or modify host files, and access other containers through Docker. This issue is fixed in version 0.29.8.

Properties

epss_score
0.00278
cve_id
CVE-2026-72879
published_at
2026-08-10T20:17:34.420
last_modified
2026-09-08T20:54:37.790
epss_percentile
0.19978

Related Entities (3)

ENRICHED_BY (1)

[Source]FIRST EPSS

DESCRIBED_BY (1)

[Source]NVD

HAS_WEAKNESS (1)

[Weakness]Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Explore deeper with Ninja Signal's threat intelligence graph

CVE-2026-72879 — Ninja Signal Threat Intelligence | Ninja Signal