Veille CVE

‹ Retour à la liste

CVE-2026-72872

9.9 Critique

Publiée le 10/08/2026 à 21:17 · Modifiée le 08/09/2026 à 22:54 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, application.saveBitbucketProvider stores bitbucketOwner and bitbucketRepository without validation and cloneBitbucketRepository in packages/server/src/utils/providers/bitbucket.ts interpolates those values into git clone commands executed through execAsync or execAsyncRemote, allowing a member with service deployment permission to execute arbitrary operating system commands on the Dokploy host or target server. This issue is fixed in version 0.29.13.

Traduire en français

Produits concernés

Scores CVSS

VersionScoreSourceVecteur
3.1 9.9 Critique security-advisories@github.com CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Faiblesses (CWE)

Références

Ailleurs