CVE-2026-72884

The CVSS 8.7 assigned to this command injection vulnerability in Dokploy is misleading for the deployment model where this software actually runs. The flaw lies in sanitizeCommand(), which strips whitespace and surrounding quotes but performs no meaningful validation of shell metacharacters — a function that should never have existed as a mitigation in the first place. The deeper failure is architectural: Dokploy passes compose.command to Docker as a string requiring shell interpolation rather than as a native argument array. This is the fundamental design error. String-based sanitization of shell metacharacters is inherently fragile and should be treated as a red flag during code review — it treats the symptom, not the cause. The correct fix is to refactor the command execution path to use Docker's native argument handling, eliminating the shell context entirely. More critically, the authentication requirement in the CVSS calculation assumes a meaningful trust boundary that doesn't exist in Dokploy's primary deployment context. Self-hosted PaaS installations typically serve small teams or individuals where authenticated users and host operators are the same principals. The "authenticated attacker" qualifier in the severity score is effectively hollow — an attacker who can update a compose service already has legitimate access to the host in most threat models. If you run Dokploy self-hosted, treat this as a critical vulnerability regardless of the 8.7 number. The real exposure window is measured in months post-disclosure because self-hosted operators patch slowly, if at all. Compensating controls to audit: verify which user your docker run commands execute as, consider running compose services under non-privileged users with explicit namespace isolation, and audit your deployment for inherited patterns from older Docker Compose versions that may have pushed developers toward string interpolation. The patch in 0.29.13 addresses the sanitization gap, but the architectural debt remains — prefer argument arrays in any custom command handling you add.

Reviewed through automated stages and approved by a human before publication.