CVE-2026-72874

Executive Summary

CVE-2026-72874 is an authenticated operating system command injection vulnerability in Dokploy, a free, self-hostable Platform as a Service (PaaS). Affected versions prior to 0.29.13 allow any authenticated user with application access to execute arbitrary OS commands on the Dokploy host by manipulating custom Git repository settings and triggering a deployment. Successful exploitation results in full command execution in the context of the Dokploy server process, which typically has broad access to the host and its managed application containers.

A patch is claimed in Dokploy 0.29.13; however, patch confidence is 2/4 because only a single source (OSV) confirms the fix. No public exploit, Nuclei template, or CISA KEV listing has been reported.

Technical Analysis

The vulnerability exists in the server-side Git provider utility used by Dokploy to clone custom Git repositories. The affected function is cloneGitRepository in packages/server/src/utils/providers/git.ts. According to the NVD description, this function interpolates the user-controlled fields customGitUrl and customGitBranch directly into a git clone command. That command is then passed to execAsync or execAsyncRemote.

This is a classic OS command injection vulnerability (CWE-78). When a user-supplied value is concatenated into a command string that is later interpreted by a shell, an attacker can inject shell metacharacters to terminate or chain the intended command. In this case, both the custom Git URL and the custom Git branch are attacker-controlled. Since cloneGitRepository passes the assembled string to execAsync or execAsyncRemote, a payload containing characters such as ;, &&, |, backticks, or $() will be executed by the underlying shell rather than being treated as literal arguments to git.

The attack surface is limited to authenticated users who have access to an application or project in the Dokploy instance. This is not an unauthenticated remote code execution vulnerability: the attacker must first obtain valid application access. However, in a self-hosted PaaS model, tenants or projects may be operated by different users or teams. Any user who can configure a Git repository and trigger a deployment can exploit the flaw.

The code-level mechanism is straightforward:

1. customGitUrl is set to a value such as https://example.com/repo.git; <OS command>.
2. customGitBranch may also be used as an injection point if it is not sanitized.
3. When the user saves the repository configuration and triggers a deployment, cloneGitRepository builds a git clone command from these unsanitized values.
4. The command is executed via execAsync or execAsyncRemote, and the injected OS command is interpreted by the shell.

Exploitation Scenarios

No public proof-of-concept or exploit code is currently available. The following attack chain is inferred from the vulnerability class and the details provided in the NVD description.

1. Reconnaissance and target identification
   An attacker identifies a self-hosted Dokploy instance, typically through exposed web panels, TLS certificates, or HTTP fingerprints. The attacker authenticates as any user who has application or project access. The attacker does not require administrative privileges; the flaw is reachable from the application-level Git configuration surface.

2. Flaw trigger
   The attacker navigates to the Git repository settings for an application they can modify. They set the custom Git URL field to a malicious value containing a command-injection payload. The custom Git branch field can also be used if the backend interpolates it into the same command. The attacker saves the configuration and initiates a deployment.

3. Payload execution at the vulnerability-class level
   When the deployment is triggered, the Dokploy server constructs a git clone command from the attacker-controlled customGitUrl and customGitBranch. Because these values are inserted into a shell command string without proper neutralization, shell metacharacters are honored. The attacker can use payloads such as:

   • Semicolon (;) to append a second command after the git clone command.
   • Logical AND (&&) to execute a command only if git clone appears to succeed.
   • Pipes (|), backticks, or $() to execute a command during command substitution.

4. Post-exploitation impact
   The injected command executes on the Dokploy host in the security context of the Dokploy server service. This may give the attacker the ability to read credentials, environment variables, database configuration, application source code, secrets, and other sensitive data. The attacker may also be able to create persistence, pivot to the container network, tamper with deployed applications, or disrupt availability.

Impact Assessment

The business impact of CVE-2026-72874 is high because the vulnerability converts authenticated application-level access into host-level command execution. In a PaaS deployment, this can represent a multi-tenant boundary breach: one tenant could compromise the host and potentially other tenants' applications.

• Affected systems: all Dokploy versions prior to 0.29.13.
• Attack complexity: low — the attacker supplies a malicious Git URL and triggers deployment.
• Required privileges: authenticated user with application access.
• User interaction: none.
• Blast radius: host compromise, access to managed containers, secrets, and data managed by Dokploy.

The NVD description does not include a CVSS score or vector, so no official CVSS subscores are available. Based on the vulnerability class and an assessment of the code path, the impact on confidentiality, integrity, and availability is likely severe if the compromised service account has broad filesystem and Docker access.

The EPSS score is 0.00354, indicating a low modeled probability of exploitation in the wild; the CVE is not listed in CISA KEV. These factors should not be interpreted as low business risk, because the vulnerability is easy to exploit once an attacker has authenticated access.

Detection Guidance

The following detection artifacts are intended to identify attempts to exploit this vulnerability. Detection should combine host-level process monitoring with inspection of HTTP API requests that carry the customGitUrl and customGitBranch fields.

Sigma Rule

title: Dokploy Git Clone OS Command Injection Attempt
status: experimental
description: Detects git clone processes spawned from a shell with suspicious command injection metacharacters in the command line.
logsource:
    category: process_creation
    product: linux
detection:
    selection_git:
        Image|endswith:
            - '/git'
        CommandLine|contains: 'clone'
    selection_parent:
        ParentImage|endswith:
            - '/sh'
            - '/bash'
            - '/dash'
            - '/ash'
    selection_meta:
        CommandLine|contains:
            - ';'
            - '&&'
            - '|'
            - '`'
            - '$('
    condition: selection_git and selection_parent and selection_meta
falsepositives:
    - Limited; legitimate git clone commands rarely contain shell metacharacters. A benign Git URL with a '&' query string may produce a false positive.
level: high

YARA Rule

rule Dokploy_Git_Command_Injection
{
    meta:
        author = "Valters IT Security"
        description = "Detects payloads referencing Dokploy customGitUrl or customGitBranch fields with OS command injection metacharacters."
        reference = "CVE-2026-72874"
        date = "2026-06-01"
    strings:
        $url = "customGitUrl" nocase
        $branch = "customGitBranch" nocase
        $clone = "git clone" nocase
        $semi = /customGitUrl[^\r\n]{0,200};/ nocase
        $and = /customGitUrl[^\r\n]{0,200}&&/ nocase
        $pipe = /customGitUrl[^\r\n]{0,200}\|/ nocase
        $sub = /customGitUrl[^\r\n]{0,200}\$\(/ nocase
        $bt = /customGitUrl[^\r\n]{0,200}`/ nocase
    condition:
        ($url or $branch) and $clone and 1 of ($semi, $and, $pipe, $sub, $bt)
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Dokploy Custom Git URL OS Command Injection Attempt"; flow:established,to_server; content:"customGitUrl"; http_client_body; pcre:"/customGitUrl[^\r\n]{0,200}(?:;|\&\&|\||\$\()/i"; classtype:attempted-admin; sid:202672874; rev:1;)

Elastic Detection

process where process.name == "git" and process.args : "clone" and (
  process.command_line : "*;*" or
  process.command_line : "*&&*" or
  process.command_line : "*|*" or
  process.command_line : "*`*" or
  process.command_line : "*$(*"
)

Splunk SPL Query

index=linux_* sourcetype=linux_audit
| search "git clone"
| where match(command_line, "(?i)git clone[^\r\n]*(;|&&|\||`|\\$\()")
| table _time, host, user, command_line

index=* sourcetype=*dokploy* OR sourcetype=*nginx*
| search "customGitUrl" OR "customGitBranch"
| where match(payload, "(?i)(;|&&|\||`|\\$\()")
| table _time, src_ip, user, http_method, uri, payload

Wazuh OSSEC Rule

<group name="dokploy,command_injection,">
  <rule id="100728" level="12">
    <match>git clone.*(;|\&\&|\||\`|\$\()</match>
    <description>Dokploy custom Git URL OS command injection attempt detected</description>
    <group>dokploy,command_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4: the fix is claimed only by OSV and has not been independently confirmed. Treat the upgrade as the primary remediation step but also apply layered controls.

1. Immediate mitigations

   • Upgrade to Dokploy 0.29.13 or later as soon as the upgrade can be validated in your environment.
   • Restrict access to Git repository configuration to trusted administrators only. If the platform supports role-based access control, remove the ability for normal application users to set custom Git URLs.
   • Monitor deployment and Git clone activity for unexpected shell metacharacters in repository URLs and branch names.
   • If host-level isolation is available, run the Dokploy server process with a dedicated, least-privilege service account and strict filesystem/container access restrictions.

2. Patch and upgrade steps

   • Download the fixed release 0.29.13 from the official Dokploy distribution channel.
   • Verify the release checksum/signature before deployment.
   • Perform a backup of the Dokploy configuration, database, and application data.
   • Apply the upgrade in a staging environment first and verify existing Git clone and deployment workflows.
   • Confirm that packages/server/src/utils/providers/git.ts no longer passes unsanitized customGitUrl and customGitBranch values to shell execution functions.

3. Long-term hardening

   • Replace shell-string construction with parameterized command execution APIs wherever possible.
   • Implement strict input validation and allow-listing for Git URL schemes, hosts, and branch names.
   • Require multi-factor authentication for all users who can create or modify applications.
   • Isolate Dokploy hosts from other critical infrastructure and restrict outbound network access from the host.
   • Maintain audit logging of all shell process creation and deployment API requests, and integrate those logs into the SIEM.
   • Monitor OSV and vendor advisories for follow-up fixes or further patch confirmation.

References

• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72874
• Dokploy official project and release history: https://github.com/Dokploy/dokploy
• OSV vulnerability database: search osv.dev for CVE-2026-72874 — patch source reference
• CISA Known Exploited Vulnerabilities catalog: CVE-2026-72874 is not currently listed
• MITRE ATT&CK: T1059 — Command and Scripting Interpreter for the post-exploitation execution phase

No known threat actor campaigns or active exploitation in the wild have been reported for CVE-2026-72874 at the time of writing.