CVE-2026-72881

This CVE exposes a command injection vulnerability in Dokploy's backup utilities affecting versions prior to 0.29.13. The backup system constructs shell commands by interpolating database names, usernames, and passwords directly into nested shell calls for five database engines: PostgreSQL, MariaDB, MySQL, MongoDB, and LibSQL. If you administer a Dokploy instance, treat this as critical not because of CVSS 6.4, but because the blast radius of a successful exploit gives an attacker pivot into all five database containers simultaneously—often with overprivileged container network configurations in a PaaS context. The underlying failure isn't developer negligence. It's structural: the PaaS backup abstraction layer offers no safe-by-default primitives for building these commands across heterogeneous database backends. Shell string interpolation is the only universal mechanism, and it makes injection the path of least resistance. Under time pressure to support five engines, developers choose the working solution over a custom parameterization layer that would take weeks to build. The threat model misaligns with intuition. Database credentials are typically treated as trusted configuration in web applications—something you read from env vars, not something you defend against. Dokploy inverts this: an authenticated administrator IS the attacker surface. Self-hosted deployments often grant admin permissions loosely to contractors or team members who need database creation rights but aren't security personnel. The code looks like standard config handling, not input processing, so the escaping requirement was invisible. Your immediate actions: First, verify you're on 0.29.13 or later—update immediately. Second, examine your backup command builders and audit any `child_process.exec()` calls that interpolate database credentials or names. Third, treat all credential values as untrusted input regardless of their source; apply shell escaping or migrate to parameterized primitives where the database client supports it. Finally, treat the 0.29.13 fix as provisional: if it uses ad-hoc character-class escaping rather than architectural parameterization, expect edge-case bypasses when the sixth database backend arrives or when new configuration fields get interpolated. The pattern this CVE represents—a fix that patches today's symptom without redesigning the command construction layer—has a documented history of recurring vulnerabilities across every generation of server-side tooling. Assume the attacker is your own administrative surface, not just an external threat.

Reviewed through automated stages and approved by a human before publication.