Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds database restore shell pipelines from the user-controlled databaseName and backupFile fields without safely separating them from shell syntax. packages/server/src/utils/restore/utils.ts interpolates databaseName into database-specific restore commands, while packages/server/src/utils/restore/postgres.ts and the analogous restore modules interpolate backupFile into rclone paths. An authenticated member with backup-restore permission can inject operating-system commands that execute in the Dokploy host context through execAsync or execAsyncRemote, even when no valid database container or backup file exists. This issue is fixed in version 0.29.13.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-10T18:18:51.673Z",
  "pubdate": "2026-08-10T18:18:51.673Z",
  "executiveSummary": "A remote command injection vulnerability exists in Dokploy prior to version 0.29.13.\nThe vulnerability resides within the backup.restoreBackupWithLogs tRPC subscription, which insecurely constructs database restore shell pipelines.\nAn authenticated user with backup-restore permissions can exploit this flaw to inject arbitrary operating system commands.\nExecution occurs directly within the Dokploy host context via execution utilities such as execAsync or execAsyncRemote, bypassing the necessity for valid database containers or backup files.\nThe impact includes full host compromise, unauthorized command execution, and severe degradation of system confidentiality, integrity, and availability.\nExploitation requires authentication as a member holding specific backup-restore permissions within the affected Dokploy deployment.",
  "technicalDetails": "The root cause of the vulnerability is improper neutralization of special elements used in an OS command, commonly known as OS Command Injection.\nSpecifically, the tRPC subscription backup.restoreBackupWithLogs builds database restore shell pipelines utilizing user-controlled input fields, namely databaseName and backupFile, without implementing adequate sanitization or safely separating them from shell syntax.\nVulnerable components include packages/server/src/utils/restore/utils.ts, which interpolates databaseName directly into database-specific restore commands, and packages/server/src/utils/restore/postgres.ts (along with analogous restore modules), which interpolates backupFile directly into rclone paths.\nThe attack flow proceeds as follows: an authenticated actor with backup-restore permissions invokes the backup.restoreBackupWithLogs tRPC subscription.\nThe attacker supplies maliciously crafted input containing shell metacharacters within the databaseName or backupFile parameters.\nBecause the application passes these unsanitized parameters directly to execution sinks like execAsync or execAsyncRemote, the underlying shell interprets the injected syntax.\nThis execution happens inside the Dokploy host context even if no valid database container or backup file exists to complete a legitimate restore operation.\nAffected software versions include all Dokploy releases prior to 0.29.13.\nThe vulnerability requires active authentication and specific role permissions, but allows post-authentication actors to escalate privileges to host-level command execution."
}