Back Feedly

CVE-2026-72862 - Exploits & Severity

Feedly • August 11, 2026

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts Dokploy database service deployment functions pass user-controlled dockerImage fields unquoted into docker pull ${dockerImage} shell commands on the remote-server code path. This vulnerability is fixed in 0.29.13.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

NVD published the first details for CVE-2026-72862

A CVSS base score of 9.9 has been assigned.

Feedly found the first article mentioning CVE-2026-72862 . See article

CVE-2026-72862 - Exploits & Severity - Feedly

CVE-2026-72862 | Dokploy up to 0.29.12 mariadb.ts dockerImage os command injection

Collect, analyze, and vulnerability reports faster using AI

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2026-72862: OS Command Injection Vulnerability in Dokploy CVE-2026-72862 has been published, detailing a critical OS command injection vulnerability in Dokploy, a self-hostable PaaS. The flaw affects versions prior to 0.29.13, where user-controlled dockerImage fields are passed unquoted into shell commands. This vulnerability could allow attackers to execute arbitrary commands on the server. The CVSS base score assigned to this vulnerability is 9.9, indicating a high severity level. The vulnerability has been confirmed and is now patched in version 0.29.13. Users of Dokploy are urged to update their systems to mitigate potential exploitation. The vulnerability affects multiple database service deployment functions, including mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts. As of now, no active exploitation has been reported, but the potential for severe impact exists. 1 sources 72

Extracted Entities

CVE-2026-72862 - Exploits & Severity

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)

Vulnerabilities (1)