CVE-2026-72902

9.9 Critique

Publiée le 10/08/2026 à 22:17 · Modifiée le 08/09/2026 à 22:54 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server because registry.testRegistry and registry.testRegistryById in apps/dokploy/server/api/routers/registry.ts interpolate the password field into an execAsyncRemote shell command instead of using safeDockerLoginCommand. This issue is fixed in version 0.29.13.

Traduire en français

Produits concernés

dokploy

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.9 Critique	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-78

Références

https://github.com/Dokploy/dokploy/commit/d3f522b7a6f5100fc0fc0bff5851e48d11d459e2
https://github.com/Dokploy/dokploy/pull/4875
https://github.com/Dokploy/dokploy/releases/tag/v0.29.13
https://github.com/Dokploy/dokploy/security/advisories/GHSA-w6r4-f26v-8g36

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories