---
id: CVE-2026-72735
title: 'Dokploy is a free, self-hostable Platform as a Service (PaaS)'
summary: >-
  Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to
  0.29.13, writeTraefikConfigRemote in
  packages/server/src/utils/traefik/application.ts serializes user-controlled
  Traefik configuration with yaml.stringify and interp…
severity: critical
cvss: 9.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-77
published: '2026-08-10'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:54:37.790'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72735'
references:
  - url: >-
      https://github.com/Dokploy/dokploy/commit/92310ddb143c8e67ca95eb7db661838a76579f2e
    label: security-advisories@github.com
  - url: 'https://github.com/Dokploy/dokploy/releases/tag/v0.29.13'
    label: security-advisories@github.com
  - url: 'https://github.com/Dokploy/dokploy/security/advisories/GHSA-478p-cx3j-hghc'
    label: security-advisories@github.com
  - url: 'https://github.com/Dokploy/dokploy/security/advisories/GHSA-478p-cx3j-hghc'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00748
epssPercentile: 0.53442
ingestedAt: '2026-09-08T21:11:12.273Z'
---

## Overview

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed through execAsyncRemote. Single quotes in redirect regex and replacement fields, basic authentication usernames, domain host values, or middleware configuration can terminate the shell quoting and execute arbitrary commands on managed remote servers with the configured SSH user's privileges. This vulnerability is caused by an incomplete fix for CVE-2026-45630. This issue is fixed in version 0.29.13.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.