Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, application.saveBitbucketProvider stores bitbucketOwner and bitbucketRepository without validation and cloneBitbucketRepository in packages/server/src/utils/providers/bitbucket.ts interpolates those values into git clone commands executed through execAsync or execAsyncRemote, allowing a member with service deployment permission to execute arbitrary operating system commands on the Dokploy host or target server. This issue is fixed in version 0.29.13.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-10T19:17:36.177Z",
  "pubdate": "2026-08-10T19:17:36.177Z",
  "executiveSummary": "Dokploy prior to version 0.29.13 is susceptible to an OS command injection vulnerability within the Bitbucket provider integration. The vulnerability allows authenticated users with service deployment permissions to execute arbitrary operating system commands on the Dokploy host or target server.\nThe root cause stems from the insecure storage and handling of repository configuration parameters, specifically bitbucketOwner and bitbucketRepository, which are persisted without input validation and subsequently interpolated directly into shell execution routines.\nSuccessful exploitation of this flaw grants an attacker full system execution capabilities under the privileges of the Dokploy service process, posing critical risks to host integrity, confidentiality, and availability. Exploitation requires authenticated access with service deployment permissions.",
  "technicalDetails": "The vulnerability resides in the application.saveBitbucketProvider functionality and the cloneBitbucketRepository utility located in packages/server/src/utils/providers/bitbucket.ts within Dokploy prior to version 0.29.13.\nThe root cause is a lack of input validation and sanitization when storing the bitbucketOwner and bitbucketRepository parameters. When the application initiates a repository clone operation, the cloneBitbucketRepository function insecurely interpolates these unvalidated parameters directly into command strings passed to execution wrappers such as execAsync or execAsyncRemote.\nBecause the input is processed without proper escaping, an attacker possessing service deployment permissions can supply maliciously crafted strings containing shell metacharacters (such as semicolons, pipe symbols, or backticks) via the Bitbucket provider configuration fields.\nDuring the execution of git clone commands by the server, these injected metacharacters are interpreted by the underlying operating system shell, leading to the execution of arbitrary operating system commands.\nThe attack flow requires an authenticated user with permissions to configure or deploy services. Upon submitting malicious payloads into the repository or owner fields, the user triggers the repository cloning mechanism, resulting in immediate arbitrary command execution on the Dokploy host or target server depending on the execution context of the async methods.\nThe post-exploitation impact includes complete host compromise, unauthorized access to sensitive environment variables, lateral movement within the infrastructure, and full control over the underlying server environment."
}