CVE-2026-72736

9.9 Critique

Publiée le 10/08/2026 à 20:18 · Modifiée le 08/09/2026 à 22:54 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy passes user-controlled values directly into shell commands via unquoted template literal interpolation in the registry credential testing and Docker Swarm cluster management endbpoints. Both endpoints have a safe local code path (using execFileAsync or the Docker API) but a vulnerable remote path (using execAsyncRemote which runs the shell string via SSH). This vulnerability is fixed in 0.29.13.

Traduire en français

Produits concernés

dokploy

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.9 Critique	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-77

Références

https://github.com/Dokploy/dokploy/commit/df2779eaeb4a58f0c85d4caa713c776c790fa708
https://github.com/Dokploy/dokploy/releases/tag/v0.29.13
https://github.com/Dokploy/dokploy/security/advisories/GHSA-4mfc-grxw-6858

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories