Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription passes the databaseName parameter to restore builders in packages/server/src/utils/restore/utils.ts, where PostgreSQL, MariaDB, MySQL, and MongoDB commands embed the value in nested shell text executed by Node.js exec. An authenticated user with backup:restore permission can supply a crafted databaseName that the host /bin/sh expands before docker exec, resulting in arbitrary commands running in the Docker-privileged host context. This issue is fixed in version 0.29.13.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-10T19:17:35.753Z",
  "pubdate": "2026-08-10T19:17:35.753Z",
  "executiveSummary": "A critical remote code execution vulnerability exists in Dokploy prior to version 0.29.13, specifically within the backup.restoreBackupWithLogs tRPC subscription. The flaw allows an authenticated user with backup:restore permissions to execute arbitrary commands within the Docker-privileged host context. The vulnerability stems from improper neutralization of special elements used in an OS command, commonly known as OS Command Injection. By supplying a maliciously crafted databaseName parameter, an attacker can leverage shell expansion mechanisms in the underlying operating system to break out of the intended database restoration context and execute arbitrary system commands. This poses a severe risk to the confidentiality, integrity, and availability of the host system, as successful exploitation grants the attacker elevated privileges on the underlying infrastructure hosting the PaaS solution. Remediation requires updating Dokploy to version 0.29.13 or later, where the underlying restore builders in packages/server/src/utils/restore/utils.ts have been appropriately patched to prevent unsafe shell execution.",
  "technicalDetails": "The vulnerability resides in the backup.restoreBackupWithLogs tRPC subscription of Dokploy, affecting versions prior to 0.29.13. The root cause is the unsafe handling of user-supplied input within database restoration utility functions located at packages/server/src/utils/restore/utils.ts. Specifically, the databaseName parameter provided by the client is passed directly into restore builders designed to interact with various database engines, including PostgreSQL, MariaDB, MySQL, and MongoDB. Within these routines, the databaseName value is embedded directly into nested shell text strings that are subsequently executed by Node.js exec without proper sanitization or parameterization.\nDuring execution, Node.js invokes the host shell (/bin/sh) to evaluate the constructed command string before executing the intended docker exec operations. Because the shell parses the input string, an authenticated user possessing the backup:restore permission can supply a crafted databaseName payload containing shell metacharacters, command separators, or subshell expansions. When the shell processes the concatenated string, it interprets the attacker's input as executable commands rather than a literal database identifier.\nThe step-by-step attack flow begins with the attacker authenticating to the Dokploy platform with an account granted the necessary backup:restore permission. The attacker then initiates a tRPC subscription request to backup.restoreBackupWithLogs, injecting the malicious command payload into the databaseName parameter. The backend service forwards this parameter to the restore utility, which interpolates the value into an unsafe shell command string. Upon invoking Node.js exec, /bin/sh evaluates the string, allowing the injected commands to break out of the intended operational scope. Because the underlying application runs within a Docker-privileged host context or interacts directly with the host daemon environment, the resulting command execution inherits these elevated privileges. Consequently, post-exploitation impact includes full system compromise, unauthorized access to sensitive data, manipulation of container instances, and potential lateral movement across the surrounding network architecture."
}