Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed through execAsyncRemote. Single quotes in redirect regex and replacement fields, basic authentication usernames, domain host values, or middleware configuration can terminate the shell quoting and execute arbitrary commands on managed remote servers with the configured SSH user's privileges. This vulnerability is caused by an incomplete fix for CVE-2026-45630. This issue is fixed in version 0.29.13.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-10T18:18:51.977Z",
  "pubdate": "2026-08-10T18:18:51.977Z",
  "executiveSummary": "An arbitrary command execution vulnerability exists in Dokploy prior to version 0.29.13. The flaw arises from insecure serialization and shell interpolation within Traefik configuration management routines, serving as an incomplete fix for CVE-2026-45630.\nAttackers can leverage user-controlled fields such as redirect regex and replacement values, basic authentication usernames, domain host values, or middleware configurations to break out of shell quoting mechanisms.\nSuccessful exploitation allows malicious actors to execute arbitrary operating system commands on managed remote servers under the privileges of the configured SSH user.\nThe vulnerability directly impacts Dokploy self-hostable Platform as a Service deployments before version 0.29.13, posing critical risks to infrastructure confidentiality, integrity, and availability.\nExploitation requires the ability to supply malicious input fields processed by the configuration generation logic, though it can be triggered by authenticated or unauthenticated vectors depending on the specific application exposure and input attack surface.",
  "technicalDetails": "The vulnerability resides in the writeTraefikConfigRemote function located within the packages/server/src/utils/traefik/application.ts file of the Dokploy codebase.\nThe root cause stems from insecure handling of user-supplied data during Traefik configuration generation. Specifically, the application serializes user-controlled configuration parameters using yaml.stringify and subsequently interpolates the resulting yamlStr directly into an echo command string.\nThis constructed command string is then executed through the execAsyncRemote execution utility.\nBecause single quotes within user-controllable fields—including redirect regex parameters, replacement fields, basic authentication usernames, domain host values, and various middleware configurations—are not properly sanitized or escaped, an attacker can prematurely terminate the shell quoting context.\nThe step-by-step attack flow involves an attacker submitting specially crafted input containing single quotes and arbitrary shell commands into one of the vulnerable configuration fields.\nWhen the application processes this input, the yaml.stringify function serializes the payload, and the subsequent string interpolation injects the raw payload into the echo command passed to the remote execution layer.\nThe shell interprets the injected single quotes, breaks out of the intended argument boundary, and executes the attacker-supplied system commands.\nThe affected component is the remote Traefik configuration writer routine handling application deployment settings across managed remote servers.\nAffected versions include all Dokploy releases prior to 0.29.13.\nThe impact of successful exploitation includes full remote code execution on managed remote targets with the privileges of the configured SSH user, enabling post-exploitation activities such as lateral movement, data exfiltration, and full system compromise."
}