CVE-2026-72875

Executive Summary

CVE-2026-72875 is a pre-authentication-adjacent command injection vulnerability in Dokploy, a free and self-hostable Platform as a Service (PaaS) solution. An authenticated user possessing the traefikFiles.read permission can exploit improper shell metacharacter handling in the Traefik configuration file reading functionality to execute arbitrary commands on managed servers with the privileges of the Dokploy service. The vulnerability carries a CVSS score of 8.8 (High) and affects all versions prior to 0.29.13, with a fix released in that version. Successful exploitation results in full compromise of the affected managed server, including data confidentiality, integrity, and availability impacts.

Technical Analysis

Vulnerability Mechanism

CVE-2026-72875 is a command injection vulnerability classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The root cause lies in the insecure construction of shell commands within the Dokploy application's Traefik configuration management subsystem.

The vulnerable code path involves three distinct components working in sequence:

1. settings.readTraefikFile in apps/dokploy/server/api/routers/settings.ts — This is the initial API endpoint that handles requests to read Traefik configuration files. It accepts a file path argument from the caller without adequate input validation or sanitization beyond what is minimally required.

2. apiReadTraefikConfig — This function receives the user-supplied path and passes it through to the configuration reading utility without imposing additional restrictions on the path's contents. The path is not validated to reject shell metacharacters or special characters that could be interpreted by a command shell.

3. readConfigInPath in packages/server/src/utils/traefik/application.ts — This function performs the actual file read operation. Critically, it constructs a shell command by interpolating the user-supplied configPath directly into the string cat ${configPath}, which is then passed to execAsyncRemote for execution on the managed server.

The vulnerability exists because the cat ${configPath} command template does not quote or escape the interpolated path value. An attacker who can control the configPath value can inject additional shell commands by appending shell metacharacters such as ;, |, &&, or backticks. For example, a payload like /etc/traefik/traefik.yml; id would cause the shell to first execute the intended cat command and then execute the injected id command.

Attack Surface

The attack surface for this vulnerability consists of:

• Affected component: The Dokploy settings API endpoint responsible for reading Traefik configuration files.
• Authentication requirement: An attacker must possess a valid account with the traefikFiles.read permission on the Dokploy instance. This is a low-privilege permission typically assigned to users who need to inspect Traefik configurations, meaning the vulnerability does not require administrative rights.
• Remote exploitability: The vulnerability is remotely exploitable over the network, as the affected API endpoint is exposed through the Dokploy web interface.
• Execution environment: Commands are executed on managed servers via execAsyncRemote, meaning the attack impacts the server(s) managed by the Dokploy instance rather than necessarily the Dokploy host itself.

Technical Severity

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reveals:

• Attack Vector: Network (N) — Exploitable remotely without physical access.
• Attack Complexity: Low (L) — No special conditions or race conditions required; the vulnerability is straightforward to exploit.
• Privileges Required: Low (L) — Only the traefikFiles.read permission is needed, which is a low-privilege role.
• User Interaction: None (N) — No victim interaction is required.
• Scope: Unchanged (U) — The vulnerability affects only the targeted managed server, not other security scopes.
• Confidentiality/Integrity/Availability Impact: High (H/H/H) — Full impact across all three security pillars.

The resulting score of 8.8 (High) reflects the severity of the impact relative to the low access requirements.

Exploitation Scenarios

Important note: No public proof-of-concept or exploit code has been identified at the time of this report. The attack chain below is inferred from the vulnerability class (command injection) and the specific code path described in the NVD entry.

Step 1: Reconnaissance and Target Identification

An attacker begins by identifying exposed Dokploy instances. These can be discovered through internet-wide scanning using search engine dorking (e.g., title:"Dokploy" or body:"dokploy" via Shodan or similar services) or through targeted reconnaissance of organizations known to use self-hosted PaaS solutions. Once a target is identified, the attacker enumerates the web application to confirm it is running a vulnerable version (prior to 0.29.13). Version identification may be performed by examining the login page footer, API responses, or known static resource version markers.

Step 2: Gaining the Required Permission Level

The attacker must obtain valid credentials for a user account with the traefikFiles.read permission. Attack vectors include:

• Credential stuffing or brute-force attacks against the login endpoint using previously compromised credentials.
• Social engineering to trick an administrator into granting a lower-privileged account access to Traefik configuration viewing.
• Leveraging default or weak credentials on self-hosted instances where administrators have not changed initial passwords.
• Exploitation of other, unrelated vulnerabilities to obtain session tokens or credentials.

Once authenticated with the required permission, the attacker can access the settings API endpoint that exposes the vulnerable functionality.

Step 3: Crafting and Delivering the Payload

The attacker crafts a crafted file path containing shell metacharacters and submits it to the vulnerable settings.readTraefikFile API endpoint. At the vulnerability-class level, the payload follows the standard command injection pattern: an intended file path followed by a command separator and the injected command. Examples of such injection patterns include (at the class level, not specific to this codebase):

• Appending ; <command> after the file path
• Appending || <command> for conditional execution
• Appending $(<command>) for command substitution
• Using backticks `<command>` for command substitution

The injected command is executed on the managed server via execAsyncRemote, inheriting the privileges of the Dokploy service process running on that server.

Step 4: Post-Exploitation Impact

Upon successful execution, the attacker achieves remote code execution on the managed server. Recovery of the initial output may be possible if the command output is returned to the caller or logged. The attacker can then:

• Exfiltrate sensitive application data, environment variables, and secret keys stored on the managed server.
• Establish persistence through backdoors, reverse shells, or scheduled tasks.
• Pivot to other systems within the internal network, using the compromised managed server as a foothold.
• Deploy ransomware or destructive payloads, affecting service availability.
• Access cloud credentials if the managed server has IAM role assignments or stored API keys.

The high confidentiality, integrity, and availability impact scores indicate that a successful exploit allows full control over the managed server's data and operations.

Impact Assessment

Business Impact

The successful exploitation of CVE-2026-72875 results in arbitrary command execution on managed servers within a Dokploy PaaS environment. For organizations relying on Dokploy to host production applications, this represents a critical risk:

1. Data Breach Potential: Managed servers often host application source code, environment variables containing API keys, database credentials, and customer data. Full command execution enables wholesale data exfiltration.

2. Lateral Movement: The compromised managed server can serve as a launch point for attacks against the broader internal network, potentially leading to compromise of the entire infrastructure.

3. Service Disruption: Attackers can delete files, stop services, or deploy destructive payloads, leading to prolonged downtime and potential irreversible data loss.

4. Compliance and Legal Exposure: Organizations subject to regulatory frameworks (GDPR, HIPAA, PCI-DSS, etc.) may face reportable breach obligations and legal consequences.

5. Reputational Damage: A publicly disclosed breach of a self-hosted PaaS platform can significantly erode customer and stakeholder trust.

Affected Systems

All Dokploy deployments running versions prior to 0.29.13 are vulnerable. This includes self-hosted deployments used by development teams, internal platform engineering groups, and commercial SaaS providers built on top of Dokploy. The vulnerability is especially impactful for multi-tenant deployments where a single Dokploy instance manages multiple application servers.

Blast Radius

The CVSS subscores identify the blast radius as:

• Confidentiality Impact: High — Complete disclosure of all files and data on the managed server.
• Integrity Impact: High — Complete compromise of data integrity; attacker can modify or delete any file and alter system behavior.
• Availability Impact: High — Complete loss of availability; attacker can shut down services or render the system inoperable.

Because the impact is scoped to the targeted managed server (Scope: Unchanged), the immediate blast radius is limited to that server, though subsequent post-exploitation activities can expand the reach.

Detection Guidance

The following detection rules are designed to identify potential exploitation attempts of CVE-2026-72875. Since the vulnerability is triggered through an authenticated API request with shell metacharacters, detections focus on unusual HTTP requests to the affected endpoint and anomalous process execution on managed servers.

Sigma Rule

title: Dokploy Command Injection via Traefik Config Read
id: 5a4d8f2e-1c9b-4d3a-9f6e-8b2a1c5d7e3f
status: experimental
description: Detects attempts to exploit CVE-2026-72875 - command injection through shell metacharacters in the readTraefikFile endpoint
author: ValtersIT Threat Intelligence
date: 2026/01/01
logsource:
    category: webserver
    product: dokploy
    service: web
detection:
    selection:
        http.url|contains|all:
            - 'settings'
            - 'readTraefik'
        http.url|contains|any:
            - ';'
            - '|'
            - '&&'
            - '||'
            - '`'
            - '$('
    condition: selection
falsepositives:
    - Legitimate file paths containing semicolons (unlikely)
    - Monitoring systems that URL-encode query parameters
level: critical
tags:
    - attack.t1190
    - cve.2026-72875
    - cwe.78

YARA Rule

rule Dokploy_Command_Injection_CVE_2026_72875 {
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects command injection payloads targeting settings.readTraefikFile in Dokploy"
        cve = "CVE-2026-72875"
        date = "2026-01-01"
        reference = "NVD Description for CVE-2026-72875"
    strings:
        $api_endpoint_1 = "apiReadTraefikConfig" ascii wide
        $api_endpoint_2 = "readTraefikFile" ascii wide
        $api_endpoint_3 = "settings.ts" ascii wide
        $exec_pattern_1 = "cat ${" ascii wide
        $injection_chars_1 = "; " ascii wide
        $injection_chars_2 = "| " ascii wide
        $injection_chars_3 = "&&" ascii wide
        $injection_chars_4 = "`" ascii wide
        $injection_chars_5 = "$(" ascii wide
    condition:
        uint16(0) == 0x4D5A and
        2 of ($api_endpoint*) and
        1 of ($injection_chars*) 
        or
        1 of ($api_endpoint*) and $exec_pattern_1 and 1 of ($injection_chars*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-72875 - Dokploy Command Injection via readTraefikFile"; flow:established,to_server; content:"settings"; http_uri; content:"readTraefik"; http_uri; pcre:"/(?:;|&&|\|\||\x60|\$\()/Ui"; classtype:attempted-admin; sid:202672875; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, cve CVE-2026-72875; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-72875;)

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [network where destination.port == 443 and process.name == "node" and 
   network.direction : "ingress" and 
   event.category : "network"]
  [process where event.action == "exec" and 
   process.command_line : ("*cat*${...*", "*cat*;*", "*cat*|*") and 
   process.args : ("*;*", "*|*", "*&&*", "*`*")]

Alternative EQL focusing on HTTP layer:

any where process.name == "node" and
  process.command_line : "*readConfigInPath*" and
  (process.command_line : "*;*" or process.command_line : "*|*" or
   process.command_line : "*\`*" or process.command_line : "*\$(*")

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx
| where like(uri_path, "%settings%") AND like(uri_path, "%readTraefik%")
| regex uri_path="(;[^/]|\|[^/]|&&|\|\||\$\()"
| eval attack_type="Command Injection (CVE-2026-72875)"
| table _time, src_ip, dest_ip, method, uri_path, status, user_agent
| sort -_time

For endpoint detection:

index=endpoint sourcetype=process
| where like(process, "%node%") AND like(cmdline, "%cat%")
| regex cmdline="(;[^/]|\|[^/]|&&|\|\||\$\()"
| eval attack_type="Command Injection via Dokploy (CVE-2026-72875)"
| table _time, host, user, process, cmdline, parent_process
| sort -_time

Wazuh OSSEC Rule

<group name="dokploy,">
  <rule id="100281" level="12">
    <decoded>alert</decoded>
    <field name="url">\.settings</field>
    <field name="url" type="pcre">readTraefik</field>
    <field name="url" type="pcre">(;[^/]|\|[^/]|&&|\|\||\$\()</field>
    <description>CVE-2026-72875 - Potential Dokploy command injection attempt via readTraefikFile endpoint</description>
    <group>attack,exploit,cve-2026-72875,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
    <alert>always</alert>
  </rule>

  <rule id="100282" level="12">
    <decoded>alert</decoded>
    <field name="command" type="pcre">cat\s+.*;(.*?)</field>
    <description>CVE-2026-72875 - Command injection payload executed on managed server (cat with trailing semicolon)</description>
    <group>attack,execution,command_injection,cve-2026-72875,</group>
    <mitre>
      <id>T1059</id>
    </mitre>
    <options>no_full_log</options>
    <alert>always</alert>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — No patch evidence has been identified from any tracked source at this time. The only remediation reference available is the vendor fix noted in the NVD description, which indicates the issue is fixed in version 0.29.13.

1. Immediate Mitigations (Until Upgrade Is Possible)

1. Restrict Access to the Affected Endpoint: Implement network-level access controls to limit which IP addresses or networks can reach the Dokploy web interface. Ideally, restrict access to internal networks or VPN-only access.

2. Review and Audit User Permissions: Audit all user accounts with the traefikFiles.read permission. Remove or reassign this permission for users who do not have a legitimate need to view Traefik configurations. Consider revoking this permission entirely until the patch is applied.

3. Enable Multi-Factor Authentication (MFA): While MFA does not prevent exploitation by authorized low-privilege accounts, it can reduce the risk of account takeover that could be used to reach the required permission level.

4. Deploy Web Application Firewall (WAF) Rules: Configure a WAF to inspect HTTP requests to the settings API for shell metacharacter injection patterns. Block requests containing characters such as ;, |, &, backticks, or $( in the relevant query parameters or path segments.

5. Monitor for Suspicious Activity: Implement the detection rules provided above and escalate alerts immediately for any hits, even from seemingly legitimate users with the required permission.

6. Apply Least Privilege: Ensure that the Dokploy service account on managed servers runs with the minimum privileges necessary. Restrict local file system access where possible.

2. Patch/Upgrade Steps

1. Upgrade Dokploy to Version 0.29.13 or Later: The vendor has addressed this vulnerability in version 0.29.13. Upgrade all Dokploy instances to this version or newer as soon as possible.

2. Verify the Upgrade: After upgrading, confirm the application version is reflected in the web interface and that the vulnerable settings.readTraefikFile endpoint no longer accepts shell metacharacters in path parameters.

3. Test Post-Update: Verify that legitimate Traefik configuration reading functionality still works correctly after the upgrade to ensure the fix has not introduced regressions.

3. Long-Term Hardening

1. Apply the Principle of Least Privilege (PoLP): Regularly audit user permissions and roles within Dokploy. Implement a formal access review process to ensure only necessary personnel hold permissions that could interact with sensitive system functionality.

2. Network Segmentation: Isolate managed servers from each other and from the Dokploy control plane where feasible. Limit direct internet exposure of both the Dokploy dashboard and managed servers.

3. Input Validation Standards: Work with the Dokploy vendor or community to ensure future versions implement robust input validation and parameterized or quoted shell command construction. Developers should avoid shell interpolation altogether and use safer alternatives like execFile or programmatic file reads.

4. Vulnerability Management Process: Subscribe to vendor security advisories and monitor the Dokploy GitHub repository for security-related releases. Incorporate CVE monitoring into your standard vulnerability management workflow.

5. Incident Response Preparedness: Given that no patch is yet confirmed from independent sources, prepare incident response playbooks for this specific CVE. Ensure logs are adequately captured and retained for forensic analysis should an incident occur.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72875

   • Official National Vulnerability Database entry containing the vulnerability description, CVSS vector, and CWE classification.

2. NVD CVSS Calculator: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

   • CVSS v3.1 calculator reference for score verification and environmental adjustment guidance.

3. CWE-78 (OS Command Injection): https://cwe.mitre.org/data/definitions/78.html

   • MITRE Common Weakness Enumeration entry describing the vulnerability class, including common detection and mitigation strategies.

4. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

   • ATT&CK technique reference relevant for the initial access stage of this exploitation chain.

5. Dokploy Official Website: https://dokploy.com

   • Vendor site for obtaining version updates and release notes. Review the release notes for version 0.29.13 to confirm the fix details.

Known Threat Actor Campaigns or Exploit-in-the-Wild Evidence

At the time of this report, no known threat actor campaigns have been publicly attributed to CVE-2026-72875, and no evidence of exploitation in the wild has been identified. Neither the CISA KEV (Known Exploited Vulnerabilities) catalog nor other tracked sources has listed this CVE. The exploit status is unknown, and no public PoC or Nuclei template has been identified. However, given the vulnerability class (command injection), the low privilege requirement, and the widespread use of self-hosted PaaS solutions, active exploitation attempts should be anticipated. The "not yet patched" status across multiple tracking sources increases the window of risk for affected organizations.