Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, apps/dokploy/server/api/routers/destination.ts interpolates the accessKey, secretAccessKey, region, endpoint, provider, and bucket fields from destination.testConnection into an rclone ls command executed through child_process.exec. The `withPermission("destination", "create")` path permits a low-privileged organization member to reach the mutation, close a quoted argument with a crafted field, and execute arbitrary commands in the root Dokploy container, which has access to the host Docker socket. This issue is fixed in version 0.29.13.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-10T19:17:35.600Z",
  "pubdate": "2026-08-10T19:17:35.600Z",
  "executiveSummary": "A command injection vulnerability exists in Dokploy prior to version 0.29.13.\nThe vulnerability resides within the destination test connection functionality, specifically in apps/dokploy/server/api/routers/destination.ts, where user-supplied input parameters are directly interpolated into a shell command.\nA low-privileged organization member with the 'destination' create permission can reach the vulnerable mutation.\nBy supplying crafted input that closes a quoted argument, an authenticated attacker can execute arbitrary system commands within the context of the root Dokploy container.\nBecause the root Dokploy container maintains access to the host Docker socket, successful exploitation leads to complete container breakout and full host system compromise.\nThe issue is fully resolved in version 0.29.13 by properly addressing the unsafe execution of child_process.exec.",
  "technicalDetails": "The vulnerability is caused by insecure command construction in the apps/dokploy/server/api/routers/destination.ts file.\nSpecifically, the destination.testConnection procedure processes various fields including accessKey, secretAccessKey, region, endpoint, provider, and bucket.\nThese fields are insecurely interpolated directly into an rclone ls command string rather than being passed safely as an array of arguments.\nThe resulting command string is subsequently executed using the Node.js child_process.exec function, which spawns a system shell to evaluate the string.\nAttack flow begins with an authenticated user holding low-privileged organization membership, specifically authorized via the withPermission('destination', 'create') access control check.\nThe attacker sends a malicious payload targeting the destination.testConnection mutation.\nBy incorporating shell metacharacters or closing the expected quoted argument string within one of the vulnerable fields, the attacker breaks out of the intended command structure and appends arbitrary operating system commands.\nWhen child_process.exec evaluates the interpolated string, the injected commands are executed with the privileges of the Dokploy server process inside the root container.\nPost-exploitation impact is severe: the root Dokploy container has access to the host Docker socket, allowing the attacker to manipulate the underlying Docker daemon, spawn privileged containers on the host, mount the host filesystem, and achieve full administrative control over the host infrastructure."
}