CVE-2026-72735

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72735", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-10T13:48:09.546Z", "datePublished": "2026-08-10T17:34:36.325Z", "dateUpdated": "2026-08-10T18:38:07.764Z"}, "containers": {"cna": {"title": "Dokploy: Command injection in writeTraefikConfigRemote via shell interpolation of unescaped YAML in SSH remote execution", "problemTypes": [{"descriptions": [{"cweId": "CWE-77", "lang": "en", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-478p-cx3j-hghc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-478p-cx3j-hghc"}, {"name": "https://github.com/Dokploy/dokploy/commit/92310ddb143c8e67ca95eb7db661838a76579f2e", "tags": ["x_refsource_MISC"], "url": "https://github.com/Dokploy/dokploy/commit/92310ddb143c8e67ca95eb7db661838a76579f2e"}, {"name": "https://github.com/Dokploy/dokploy/releases/tag/v0.29.13", "tags": ["x_refsource_MISC"], "url": "https://github.com/Dokploy/dokploy/releases/tag/v0.29.13"}], "affected": [{"vendor": "Dokploy", "product": "dokploy", "versions": [{"version": "< 0.29.13", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-10T17:34:36.325Z"}, "descriptions": [{"lang": "en", "value": "Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed through execAsyncRemote. Single quotes in redirect regex and replacement fields, basic authentication usernames, domain host values, or middleware configuration can terminate the shell quoting and execute arbitrary commands on managed remote servers with the configured SSH user's privileges. This vulnerability is caused by an incomplete fix for CVE-2026-45630. This issue is fixed in version 0.29.13."}], "source": {"advisory": "GHSA-478p-cx3j-hghc", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-478p-cx3j-hghc", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-10T18:34:41.217179Z", "id": "CVE-2026-72735", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T18:38:07.764Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72735", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-10T18:34:41.217179Z"}}}], "references": [{"url": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-478p-cx3j-hghc", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T18:37:23.871Z"}}], "cna": {"title": "Dokploy: Command injection in writeTraefikConfigRemote via shell interpolation of unescaped YAML in SSH remote execution", "source": {"advisory": "GHSA-478p-cx3j-hghc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Dokploy", "product": "dokploy", "versions": [{"status": "affected", "version": "< 0.29.13"}]}], "references": [{"url": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-478p-cx3j-hghc", "name": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-478p-cx3j-hghc", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Dokploy/dokploy/commit/92310ddb143c8e67ca95eb7db661838a76579f2e", "name": "https://github.com/Dokploy/dokploy/commit/92310ddb143c8e67ca95eb7db661838a76579f2e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Dokploy/dokploy/releases/tag/v0.29.13", "name": "https://github.com/Dokploy/dokploy/releases/tag/v0.29.13", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed through execAsyncRemote. Single quotes in redirect regex and replacement fields, basic authentication usernames, domain host values, or middleware configuration can terminate the shell quoting and execute arbitrary commands on managed remote servers with the configured SSH user's privileges. This vulnerability is caused by an incomplete fix for CVE-2026-45630. This issue is fixed in version 0.29.13."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-10T17:34:36.325Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72735", "state": "PUBLISHED", "dateUpdated": "2026-08-10T18:38:07.764Z", "dateReserved": "2026-08-10T13:48:09.546Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-10T17:34:36.325Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "dokploy", "vendor": "Dokploy", "versions": [{"status": "affected", "version": "< 0.29.13"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed through execAsyncRemote. Single quotes in redirect regex and replacement fields, basic authentication usernames, domain host values, or middleware configuration can terminate the shell quoting and execute arbitrary commands on managed remote servers with the configured SSH user's privileges. This vulnerability is caused by an incomplete fix for CVE-2026-45630. This issue is fixed in version 0.29.13."}], "id": "CVE-2026-72735", "lastModified": "2026-09-08T20:54:37.790", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72735", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-10T18:34:41.217179Z", "version": "2.0.3"}}]}, "published": "2026-08-10T18:18:51.977", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Dokploy/dokploy/commit/92310ddb143c8e67ca95eb7db661838a76579f2e"}, {"source": "security-advisories@github.com", "url": "https://github.com/Dokploy/dokploy/releases/tag/v0.29.13"}, {"source": "security-advisories@github.com", "url": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-478p-cx3j-hghc"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-478p-cx3j-hghc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.29.13)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "dokploy", "source": "cna", "vendor": "Dokploy"}, "product": "dokploy", "vendor": "dokploy"}], "created": "2026-08-10T19:45:04.446776+00:00", "updated": "2026-08-11T03:45:03.263437+00:00", "vendors": ["dokploy", "dokploy$PRODUCT$dokploy"]}