https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 06:28:41 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-72878 <p>Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy&#39;s backup and restore pipeline constructs shell commands by directly interpolating user-controlled database fields into bash -c &#34;...&#34; and sh -c &#34;...&#34; strings, then executes them via child_process.exec(). An authenticated admin/owner can inject arbitrary OS commands that execute on the host machine running Dokploy (not just inside a container). This vulnerability is fixed in 0.29.13.</p> <p>Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy&#39;s backup and restore pipeline constructs shell commands by directly interpolating user-controlled database fields into bash -c &#34;...&#34; and sh -c &#34;...&#34; strings, then executes them via child_process.exec(). An authenticated admin/owner can inject arbitrary OS commands that execute on the host machine running Dokploy (not just inside a container). This vulnerability is fixed in 0.29.13.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-72878