Critical Vulnerability in Dokploy PaaS Exposes Cloud Databases to Remote Code Execution

A critical security vulnerability, identified as CVE-2026-72862, has been discovered in Dokploy, a self-hostable Platform-as-a-Service (PaaS) solution. This flaw, present in versions prior to 0.29.13, allows authenticated users to achieve remote code execution (RCE) on the host system. The vulnerability stems from the improper handling of user-controlled `dockerImage` fields within Dokploy's database service deployment functions (specifically `mariadb.ts`, `mongo.ts`, `mysql.ts`, `postgres.ts`, `redis.ts`, and `libsql.ts`). These fields were passed unquoted into `docker pull ${dockerImage}` shell commands on the remote-server code path, creating a classic command injection scenario. The issue has been addressed in Dokploy version 0.29.13. This vulnerability carries significant implications for any organization utilizing Dokploy for their cloud database deployments. An authenticated attacker, even with limited privileges, could exploit this flaw to execute arbitrary commands, potentially leading to full compromise of database instances, exfiltration of sensitive data, or disruption of services. For DevOps and cloud engineers, this highlights the persistent challenge of securing the underlying infrastructure even when operating within a PaaS abstraction. The ease with which this type of injection can occur, particularly when user inputs are not rigorously sanitized, makes it a high-priority concern for data integrity and operational continuity. This incident fits into a broader, well-established trend in cloud and DevOps security: the critical importance of input validation and secure coding practices, especially when interacting with shell commands or system processes. Command injection vulnerabilities are a long-standing threat, and their recurrence in modern PaaS environments underscores that even with advanced tooling, fundamental security principles remain paramount. It also emphasizes that while PaaS solutions abstract away much of the infrastructure complexity, the responsibility for patching and monitoring the platform itself, or ensuring its vendors do so diligently, ultimately rests with the consuming organization. The rise of containerization and microservices, while offering agility, also introduces new vectors for such vulnerabilities if not managed with a security-first mindset. In practice, organizations using Dokploy must immediately upgrade to version 0.29.13 or newer to patch this critical vulnerability. Beyond immediate patching, this event serves as a stark reminder for all practitioners to review their CI/CD pipelines and deployment scripts for similar command injection risks, particularly in any custom automation that integrates user-supplied or dynamic inputs with system-level commands. Implementing robust input sanitization, utilizing parameterized commands where possible, and adhering to the principle of least privilege for deployment accounts are crucial preventative measures. Furthermore, regular security audits and penetration testing of PaaS deployments, whether self-hosted or vendor-managed, are essential to identify and mitigate such deep-seated vulnerabilities before they can be exploited in the wild.