CVE-2026-72879 | Dokploy up to 0.29.7 Upload upload.ts getRegistryCommands os command injection

A vulnerability was found in Dokploy up to 0.29.7. It has been classified as very critical. This issue affects the function getRegistryCommands of the file packages/server/src/utils/cluster/upload.ts of the component Upload. The manipulation leads to os command injection.

This vulnerability is referenced as CVE-2026-72879. Remote exploitation of the attack is possible. No exploit is available.

Upgrading the affected component is recommended.