Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, packages/server/src/utils/providers/git.ts parses the user-controlled customGitUrl with sanitizeRepoPathSSH and interpolates its domain into the ssh-keyscan command from addHostToKnownHostsCommand without shell quoting, allowing an authenticated member with service deployment permission and an attached SSH key to execute arbitrary commands on the Dokploy host during deployment. This issue is fixed in version 0.29.13.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-10T18:18:52.723Z",
  "pubdate": "2026-08-10T18:18:52.723Z",
  "executiveSummary": "An authenticated command injection vulnerability exists in Dokploy prior to version 0.29.13.\nThe vulnerability allows authenticated members with service deployment permissions and an attached SSH key to execute arbitrary commands on the underlying Dokploy host.\nThe flaw stems from improper input sanitization and a lack of shell quoting when handling user-controlled parameters.\nSuccessful exploitation compromises the integrity, confidentiality, and availability of the host running the PaaS environment.\nThe attack requires authentication, service deployment permissions, and an attached SSH key.\nThe issue is resolved in version 0.29.13 by properly securing command interpolation.",
  "technicalDetails": "The vulnerability resides in the packages/server/src/utils/providers/git.ts file within Dokploy.\nSpecifically, the input parameter customGitUrl is processed using the sanitizeRepoPathSSH function.\nThe parsed domain from customGitUrl is subsequently interpolated directly into the ssh-keyscan command string invoked by addHostToKnownHostsCommand.\nBecause the domain is interpolated without proper shell quoting or argument separation, malicious payloads containing shell metacharacters can be injected.\nThe affected component is the Git provider integration utility responsible for SSH host verification during repository configuration.\nAffected versions include all Dokploy installations prior to version 0.29.13.\nExploitation requires an attacker to possess authenticated access to the platform, specific service deployment permissions, and an attached SSH key.\nDuring the deployment phase, when the application attempts to execute ssh-keyscan against the maliciously crafted customGitUrl, the operating system shell interprets the injected commands alongside the command arguments.\nThis results in arbitrary command execution on the host system operating at the privilege level of the Dokploy server process, potentially leading to full host compromise and post-exploitation activities such as lateral movement or data exfiltration."
}