Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.listBackupFiles tRPC endpoint in apps/dokploy/server/api/routers/backup.ts passes the search parameter through normalizeS3Path and interpolates it into an rclone lsjson command executed by child_process.exec(), allowing an authenticated user with backup:read permission to execute arbitrary commands on the Dokploy host. This issue is fixed in version 0.29.13.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-10T18:18:52.430Z",
  "pubdate": "2026-08-10T18:18:52.430Z",
  "executiveSummary": "A remote command execution vulnerability has been identified in Dokploy prior to version 0.29.13, affecting the backup.listBackupFiles tRPC endpoint. This flaw allows authenticated attackers to execute arbitrary system commands on the underlying host operating system.\nThe vulnerability stems from improper sanitization and direct interpolation of input parameters into a system command execution routine. Successful exploitation grants the attacker the ability to execute arbitrary commands with the privileges of the Dokploy server process, leading to complete host compromise.\nExploitation requires authentication with specific backup:read permissions within the application. The issue impacts self-hosted deployments of Dokploy prior to the patched version 0.29.13. The risk implication is critical, as it bridges application-layer functionality to host-level command execution, completely bypassing intended architectural boundaries.",
  "technicalDetails": "The root cause of the vulnerability resides in the apps/dokploy/server/api/routers/backup.ts file, specifically within the backup.listBackupFiles tRPC endpoint. When processing user-supplied input via the search parameter, the application passes the data through the normalizeS3Path function.\nFollowing normalization, the input is insecurely interpolated directly into an rclone lsjson command string. This constructed command string is subsequently passed to the Node.js child_process.exec() function for execution on the host operating system.\nBecause child_process.exec() spawns a shell to execute the command string, an authenticated user capable of interacting with the backup.listBackupFiles endpoint can inject arbitrary shell metacharacters and commands via the search parameter. This leads to arbitrary command injection and subsequent execution.\nThe vulnerable component is the backup subsystem of Dokploy, specifically handling S3 path normalization and rclone command generation. Affected versions include all Dokploy installations prior to version 0.29.13.\nAttack requirements include network access to the Dokploy application interface, a valid user session, and the specific backup:read permission assigned to the authenticated account. No complex exploitation primitives are required due to the direct string interpolation into a shell execution context.\nThe post-exploitation impact is severe. An attacker achieving arbitrary command execution via child_process.exec() inherits the permissions of the Dokploy process, allowing them to read sensitive data, pivot to internal network segments, deploy persistence mechanisms, or inflict total system compromise on the host."
}