CVE-2026-72877

Executive Summary

CVE-2026-72877 affects Dokploy, a self-hostable PaaS, prior to version 0.29.13. An authenticated user with application create or update permission can supply a malicious dockerImage value that triggers OS command injection. The vulnerability allows arbitrary command execution on the local build host or remote SSH target, exposing host secrets and other projects. CVSS 9.6 reflects network-accessible, low-complexity exploitation with high confidentiality and integrity impact and changed scope.

Technical Analysis

The root cause is CWE-78 OS command injection. The dockerImage field is accepted as an optional string with no further validation or quoting. Inside buildRemoteDocker() in packages/server/src/utils/providers/docker.ts the field value is directly interpolated into shell commands. Because no sanitization or parameterization occurs, an attacker can embed command substitution syntax such as $(...) or backticks. Execution occurs on whichever build target the application configuration specifies, whether the local Docker host or a remote SSH host. The attack surface is limited to users who already possess application create or update rights; no unauthenticated entry point is described.

Exploitation Scenarios

1. Reconnaissance/target identification consists of locating exposed Dokploy instances and confirming an account with application create or update permission.
2. The specific flaw class is triggered by supplying a dockerImage value during application creation or update that contains unquoted shell metacharacters.
3. Payload/execution method at the vulnerability-class level uses command substitution inside the dockerImage string; the value reaches buildRemoteDocker() where it is interpolated without quoting into a shell command.
4. Post-exploitation impact includes execution of arbitrary commands on the build host, retrieval of host secrets, and access to artifacts belonging to other projects. No public PoC available; attack chain is inferred from vulnerability class.

Impact Assessment

Successful exploitation yields code execution with the privileges of the build process on either the local host or a remote SSH target. The changed-scope metric in the CVSS vector indicates that compromise of one application can affect other tenants or the underlying infrastructure. Confidentiality and integrity are fully impacted while availability remains unaffected per the provided vector. Blast radius encompasses all projects sharing the same build host or SSH credentials.

Detection Guidance

Sigma Rule

title: Dokploy dockerImage Command Injection
id: 8f4c2a1b-9e3d-4f7a-8c2b-1d9e4f3a2b1c
status: experimental
description: Detects suspicious dockerImage values containing command substitution patterns submitted to Dokploy.
logsource:
  product: dokploy
  service: application
detection:
  selection:
    event_type: application_create OR application_update
    dockerImage|contains:
      - '$('
      - '`'
      - ';'
  condition: selection
fields:
  - user
  - dockerImage
  - target_host
level: high

YARA Rule

rule Dokploy_Command_Injection_dockerImage {
    meta:
        description = "Detects command substitution patterns in Dokploy dockerImage fields"
        author = "valtersit.com"
    strings:
        $cmd1 = "$(" ascii
        $cmd2 = "`" ascii
        $field = "dockerImage" ascii
    condition:
        $field and any of ($cmd*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"Dokploy dockerImage command substitution attempt"; flow:established,to_server; http.request_body; content:"dockerImage"; pcre:"/(dockerImage.*[\$\`\(])/"; sid:2026728771; rev:1;)

Elastic Detection

sequence by user.id with maxspan=5m
  [process where process.name == "dokploy" and process.args like "*dockerImage*"]
  [process where process.args like "*$(*" or process.args like "*`*"]

Splunk SPL Query

index=dokploy sourcetype=dokploy:application (action=create OR action=update) dockerImage="*" 
| search dockerImage IN ("*$(*", "*`*", "*;*") 
| stats count by user, dockerImage, target_host

Wazuh OSSEC Rule

<rule id="634525" level="12">
  <if_sid>100001</if_sid>
  <match>dokploy.*dockerImage</match>
  <regex>[\$\`\(]</regex>
  <description>Dokploy dockerImage command injection detected</description>
  <group>attack,command_injection</group>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations include restricting application create and update permissions to trusted users and monitoring build logs for unexpected command patterns.
2. Patch/upgrade steps: upgrade to version 0.29.13 once a verified package is obtained from official sources.
3. Long-term hardening requires adding quoting or parameterization around the dockerImage value before any shell interpolation occurs in buildRemoteDocker().

References

https://nvd.nist.gov/vuln/detail/CVE-2026-72877
https://github.com/Dokploy/dokploy (vendor repository)
No known threat actor campaigns or exploit-in-the-wild evidence recorded.