CVE-2026-72877 in Dokploy before version 0.29.13 allows authenticated users with application create/update permissions to inject commands through the dockerImage field during remote builds. The vulnerability lives in buildRemoteDocker, where user-supplied image names are interpolated directly into a shell command without sanitization. The CVSS 9.6 correctly reflects severe impact, but the score masks a structural design failure that will produce similar bugs.
The core problem is architectural, not individual. Dokploy almost certainly shells out to the docker CLI rather than using the Docker API or SDK with structured types. This single implementation choice makes every build configuration field—image name, build args, tags, environment variables—a potential injection vector. The 0.29.13 patch likely adds quoting to dockerImage, which stops this specific instance but leaves the underlying pattern intact. Sibling fields remain exploitable, and future developers adding new build options will naturally reach for string interpolation because the codebase offers no structural barrier to doing so.
There is a second, underappreciated failure: Dokploy's permission model conflates operational convenience with security boundaries. Application create/update is treated as a low-privilege action, yet it grants access to a code path that can escape into the host and read secrets from unrelated projects. In a multi-tenant Dokploy instance, one authenticated user can exfiltrate secrets from all other projects. This is not a scoring edge case—it is a threat model failure where operational isolation was mistaken for security isolation.
Immediate actions: verify you are on 0.29.13 or later, audit build logs for unexpected dockerImage values, and treat any Dokploy deployment with untrusted users as having a hostile insider threat model. The deeper fix—moving to array-based process spawning or Docker API calls—is architecturally correct but resource-intensive. What matters most is recognizing that this vulnerability class is structurally enabled: tools that give users SSH build access while constructing shell commands from user input will continue to produce CVEs until the string-to-shell pattern is eliminated at the architectural level, not patched at the field level.