Global cybersecurity education and training provider OffSec has released its platform and content update for the first week of November 2026, introducing a dedicated hands-on defense lab to mitigate a critical remote code execution vulnerability discovered in the open-source platform Dokploy. Tracked under the identifier CVE-2026-72875, the flaw carries a CVSS 3.1 base score of 8.8 and is classified as an operating system command injection vulnerability under CWE-78. Dokploy is a free, self-hostable Platform as a Service designed to streamline container and application deployments across multiple servers. According to official GitHub security advisories and National Vulnerability Database records, insufficient validation and unquoted string interpolation in the Traefik reverse proxy configuration reader allow authenticated users to execute arbitrary commands across remote managed hosts. Dokploy maintainers have addressed the flaw in version 0.29.13, while security researchers urge operators to audit permissions and apply updates immediately. Direct Shell Interpolation in Traefik Configuration Reader Leads to Host Takeover Technical analysis published in GitHub advisory GHSA-j3pv-r5wg-235m and verified by the NIST National Vulnerability Database reveals that the vulnerability resides within Dokploy's server-side configuration management modules. In Dokploy deployments prior to release 0.29.13, the application exposes an API endpoint designated as settings.readTraefikFile within its settings router. While incoming requests were validated against a schema blocking directory traversal sequences and null bytes, the validation logic failed to reject shell metacharacters such as semicolons, pipes, ampersands, backticks, or subshell command substitutions.
When processing valid requests, the endpoint passes the user-supplied file path directly to the readConfigInPath helper function in the Traefik utility module. That helper constructs an operating system command by directly interpolating the configuration path into a string executed via the cat utility, subsequently dispatching the command string over SSH to the targeted managed server using the execAsyncRemote function. Because the parameters were executed without proper argument separation or quoting, an authenticated user holding routine traefikFiles.read permissions can supply crafted paths containing shell metacharacters. The command breaks out of the cat invocation, executing arbitrary commands under the permissions of the Dokploy service user on the remote host and transforming a passive configuration-reading capability into complete remote code execution. Privilege Escalation Across Managed Nodes and Multi-Tenant Clusters Security assessments by SentinelOne highlight that CVE-2026-72875 presents an attack vector characterized by low attack complexity, low privileges required, and zero user interaction requirements, represented by the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. In a standard self-hosted deployment, Dokploy operates as a centralized management controller maintaining persistent SSH connections and administrative tokens across worker infrastructure. Successful exploitation allows an authenticated member holding restricted read privileges to achieve arbitrary execution across every managed node controlled by the instance, bypassing multi-tenant isolation boundaries. Compromised nodes expose sensitive deployment environment variables, database credentials, application source code, and container secrets, while providing attackers with an operational foothold for lateral movement.
The vulnerability is part of a broader examination of command handling practices within modern open-source platform controllers. Security engineers Jayendra Yogi and Disha Sharma from Versa Networks previously disclosed five critical vulnerabilities in Dokploy—including CVE-2026-72740, CVE-2026-72733, CVE-2026-72865, CVE-2026-72872, and CVE-2026-72880—all rated CVSS 9.9. Their research demonstrated that unquoted user inputs passed directly into underlying shell commands allowed routine organization members to escalate privileges to full host compromise across managed environments. Upstream Patch Deployed in Version 0.29.13 as OffSec Unveils Defensive Cyber Range To eliminate CVE-2026-72875, the Dokploy development community merged pull request #4873 under commit 92310ddb143c8e67ca95eb7db661838a76579f2e, officially shipping the fix in release 0.29.13. The remediated code imports the quote utility from the shell-quote library to properly sanitize and escape target file paths before command construction, while remote Traefik configuration files are encoded in Base64 prior to transmission across SSH execution boundaries.
To support infrastructure defenders and systems engineers in hardening production environments, OffSec incorporated the Defend CVE-2026-72875 interactive scenario into its Defensive Cyber Range as part of an update delivering 22 new hands-on labs. The lab provides a realistic enterprise sandbox where security professionals can observe command injection mechanisms, implement hardening policies, and verify patch integrity against real-world exploit patterns. Security teams managing Dokploy controllers are advised to upgrade all instances to version 0.29.13 immediately, audit user role assignments to revoke unnecessary Traefik read permissions, and rotate operational SSH keys and credentials. For environments where immediate upgrading is impractical, administrators should restrict API access to trusted administrative networks, deploy reverse proxy rules to inspect and strip shell metacharacters, and monitor process trees on managed servers for unexpected shells spawned by the cat binary.
