{"affected":[{"product":"dokploy","source":"CNA: GitHub_M","vendor":"Dokploy","versions":[{"status":"affected","version":"< 0.29.13"}]}],"cveId":"CVE-2026-72868","cwes":["CWE-78","CWE-862"],"description":"Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, apps/dokploy/server/api/routers/destination.ts interpolates the accessKey, secretAccessKey, region, endpoint, provider, and bucket fields from destination.testConnection into an rclone ls command executed through child_process.exec. The `withPermission(\"destination\", \"create\")` path permits a low-privileged organization member to reach the mutation, close a quoted argument with a crafted field, and execute arbitrary commands in the root Dokploy container, which has access to the host Docker socket. This issue is fixed in version 0.29.13.","epss":{"date":"2026-11-09","percentile":0.53682,"score":0.00707},"exploits":[],"kev":null,"metrics":[{"score":9.9,"severity":"critical","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},{"score":9.9,"severity":"critical","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794287887080,"publishedAt":1786387148724,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/Dokploy/dokploy/security/advisories/GHSA-f6x8-vfwh-8hjr"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/Dokploy/dokploy/pull/4873"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/Dokploy/dokploy/commit/eeb6e7b8ea88e4b4b1fac8460755464100516ac9"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/Dokploy/dokploy/releases/tag/v0.29.13"},{"source":"ADP: CVE","tags":[],"url":"http://www.openwall.com/lists/oss-security/2026/11/10/2"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/Dokploy/dokploy/commit/eeb6e7b8ea88e4b4b1fac8460755464100516ac9"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/Dokploy/dokploy/pull/4873"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/Dokploy/dokploy/releases/tag/v0.29.13"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/Dokploy/dokploy/security/advisories/GHSA-f6x8-vfwh-8hjr"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"url":"http://www.openwall.com/lists/oss-security/2026/11/10/2"}],"remediation":[],"revision":"a7b9070d2bfea61142d66354fbcdb9d5f5a3c3b2df822069c2e8f6c741ae7db8","sources":[{"modifiedAt":1794287092962,"name":"CNA: GitHub_M","retrievedAt":1794290947360,"url":"https://www.cve.org/CVERecord?id=CVE-2026-72868"},{"modifiedAt":1794287887080,"name":"NVD","retrievedAt":1794291344214,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72868"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794290950913,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-72868"}],"ssvc":{"assessedAt":1786572567745,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injection","updatedAt":1794291344214}