Loading story…
Dokploy disclosed and patched CVE-2026-72878, an OS command injection vulnerability in its backup and restore pipeline that allows an authenticated admin or owner to execute arbitrary commands on the host running the self-hosted PaaS. The flaw affects versions prior to 0.29.13 and arises from user-controlled database fields being interpolated directly into bash and sh command strings executed through child_process.exec(), giving attackers a path to host-level code execution rather than confinement inside application containers.
The remediation in Dokploy 0.29.13 hardens multiple backup and restore paths by escaping shell arguments with the shell-quote library. The patch replaces unsafe interpolation across workflows involving rclone, gunzip, unzip, and restore operations for Compose, LibSQL, MariaDB, MongoDB, MySQL, PostgreSQL, and web server backups, while also protecting S3-related parameters including bucket paths, backup filenames, temporary directories, access keys, secret keys, region, endpoint, and provider.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The CVE entry for CVE-2026-72878 was received by security-advisories@github.com. The vulnerability describes an OS command injection issue in Dokploy versions prior to 0.29.13 that allows an authenticated admin or owner to execute arbitrary commands on the host machine.
Dokploy committed code changes that added shell escaping across backup, destination validation, and restore workflows to prevent unsafe interpolation of user- or configuration-controlled values into shell commands. The patch affected rclone, gunzip, unzip, and restore-related command construction across multiple components.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Splunk disclosed a high-severity **remote command execution (RCE)** vulnerability, **CVE-2026-20163** (CVSS **8.0**), affecting *Splunk Enterprise* and *Splunk Cloud Platform*. The issue is a **command injection** weakness (CWE-77) in the REST endpoint `/splunkd/__upload/indexing/preview`, where user-controlled input is insufficiently sanitized during the “uploaded file preview before indexing” workflow. Exploitation requires an authenticated user whose role includes the high-privilege capability `edit_cmd`; under that condition, an attacker can abuse the `unarchive_cmd` parameter to execute arbitrary shell commands on the underlying host. Reported affected versions include Splunk Enterprise **10.0.0–10.0.3**, **9.4.0–9.4.8**, and **9.3.0–9.3.9**, plus Splunk Cloud Platform versions below **10.2.2510.5**, **10.1.2507.16**, **10.0.2503.12**, and **9.3.2411.124**; fixed thresholds are Enterprise **10.0.4**, **9.4.9**, **9.3.10**, and **10.2.0** (with the base Enterprise **10.2** release noted as not affected). The disclosure credits researcher **Danylo Dmytriiev (DDV_UA)** along with Splunk personnel **Gabriel Nitu** and **James Ervin**.
Jun 29, 2026
Docker disclosed a high-severity Docker Engine vulnerability, **CVE-2026-34040** (`CVSS 8.8`), that allows attackers to bypass authorization plugins and perform actions that should be blocked. The flaw stems from an incomplete fix for **CVE-2024-41110** and is triggered when a specially crafted oversized Docker API request causes the request body to be dropped before inspection by an AuthZ plugin. In affected environments, the plugin may approve container operations it would otherwise deny, opening a path to unauthorized privileged actions and potential host compromise. Researchers said an attacker with Docker API access could exploit the bug by padding a container-creation request beyond **1 MB** to launch a privileged container with access to the host filesystem, exposing sensitive assets such as **AWS credentials**, **SSH keys**, and **Kubernetes configurations**. The issue affects deployments that rely on authorization plugins inspecting request bodies, while environments not using those plugins are not impacted. Docker patched the vulnerability in **Docker Engine 29.3.1** and urged defenders to upgrade, restrict Docker API access, avoid AuthZ plugins that depend on request-body inspection, and use controls such as rootless mode, user namespace remapping, and least-privilege access to reduce risk.
Jul 23, 2026
Coolify disclosed and patched **CVE-2026-59734**, a high-severity OS command injection flaw that allows an authenticated remote attacker to achieve remote code execution inside deployment containers. The vulnerability affects versions prior to `4.0.0-beta.469` and stems from unsafe interpolation of user-controlled `health_check_host`, `health_check_method`, and `health_check_path` values in `generate_healthcheck_commands()` within `app/Jobs/ApplicationDeploymentJob.php`. The issue carries a CVSS v3.1 score of **8.8**. The fix landed in Coolify via commit `0ffcee7a4dcd24f92b5fab8c9c7be140b9532733`, which adds runtime validation for user-supplied CMD health check commands with a restrictive regular expression and maximum length checks, corrects shell escaping for HTTP health check methods in generated `curl` commands, and falls back to HTTP health checks when validation fails. The patch also introduced `HealthCheckCommandInjectionTest.php`, and the vendor linked the remediation to its release, pull request, patch commit, and GitHub security advisory.
Jul 10, 2026