Feedly CVE-2026-72862: OS Command Injection Vulnerability in Dokploy
Article Content
- •CVE-2026-72862 is a critical OS command injection vulnerability in Dokploy.
- •The vulnerability affects multiple database service deployment functions prior to version 0.29.13.
- •A CVSS base score of 9.9 indicates a high severity level, and users are urged to update immediately.
CVE-2026-72862 has been published, detailing a critical OS command injection vulnerability in Dokploy, a self-hostable PaaS. The flaw affects versions prior to 0.29.13, where user-controlled dockerImage fields are passed unquoted into shell commands. This vulnerability could allow attackers to execute arbitrary commands on the server. The CVSS base score assigned to this vulnerability is 9.9, indicating a high severity level. The vulnerability has been confirmed and is now patched in version 0.29.13. Users of Dokploy are urged to update their systems to mitigate potential exploitation. The vulnerability affects multiple database service deployment functions, including mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts. As of now, no active exploitation has been reported, but the potential for severe impact exists.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (6)
Following this threat?
Track CVE-2026-72862 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical RCE Vulnerability in Langflow Exposed CVE-2026-105740 is a critical remote code execution (RCE) vulnerability affecting Langflow versions prior to 1.9.0. Authenticated users can exploit this flaw by adding an MCP server with the 'Stdio' transport, allowing arbitrary OS commands to be executed without validation. The vulnerability was published on October… 
OS Command Injection Flaw in SiteGuard WAF Exploited EG Secure Solutions disclosed that attackers are exploiting an OS command injection vulnerability in SiteGuard Server Edition, tracked as CVE-2026-106931. This flaw allows attackers to execute commands with root or SYSTEM privileges, affecting versions 2.20 and later, with the statistics feature enabled by default.…