AUGUST 15, 2026
Live Feed
Back to database
Case File

CVE-2026-72867

CRITICAL · CVSS 9.9 EPSS 0.49% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-10 · Last synced 2026-08-15

CyberRota Analysis

AI-Generated

Dokploy versions 0.29.3 to 0.29.12 are vulnerable due to inadequate server-side validation of branch fields, allowing low-privileged authenticated users to execute arbitrary commands on the host through malicious Git branch inputs. This critical vulnerability poses a significant risk to systems using Dokploy, particularly those integrated with GitLab and GitHub. Organizations utilizing these affected versions should prioritize immediate updates to version 0.29.13 to mitigate potential exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-72867
Severity
CRITICAL
CVSS
9.9
EPSS
0.49%
GitLab GitHub

Original NVD Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch, branch, gitlabBranch, bitbucketBranch, or giteaBranch. A low-privileged authenticated user can trigger compose.deploy, which passes the stored branch to shell-based Git clone commands in packages/server/src/utils/providers/git.ts, github.ts, gitlab.ts, bitbucket.ts, and gitea.ts, resulting in arbitrary host command execution. This issue is fixed in version 0.29.13.