Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, settings.readTraefikFile in apps/dokploy/server/api/routers/settings.ts passes a path accepted by apiReadTraefikConfig to readConfigInPath in packages/server/src/utils/traefik/application.ts, where configPath is interpolated into execAsyncRemote as cat ${configPath}, allowing a user with traefikFiles.read permission to execute arbitrary commands on a managed server through shell metacharacters. This issue is fixed in version 0.29.13.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-10T20:17:33.830Z",
  "pubdate": "2026-08-10T20:17:33.830Z",
  "executiveSummary": "A remote command execution vulnerability has been identified in Dokploy prior to version 0.29.13. The vulnerability stems from improper input sanitization and command injection within the Traefik file reading utility.\nAn authenticated user possessing the traefikFiles.read permission can exploit this flaw to execute arbitrary system commands on the managed server.\nThe root cause involves insecure interpolation of user-supplied paths into a shell execution context via the cat command.\nSuccessful exploitation allows malicious actors to achieve arbitrary command execution, potentially compromising the underlying server and all managed applications. The issue is resolved in version 0.29.13 by addressing the insecure configuration path handling.",
  "technicalDetails": "The vulnerability resides in the settings.readTraefikFile function located within apps/dokploy/server/api/routers/settings.ts, which passes an untrusted path parameter accepted by apiReadTraefikConfig to the readConfigInPath utility function in packages/server/src/utils/traefik/application.ts.\nWithin the underlying utility function, the provided configPath is directly interpolated into an asynchronous shell execution routine using the command pattern cat ${configPath}.\nBecause the input is embedded directly into a shell string without adequate sanitization or escaping, an attacker capable of supplying crafted input can leverage shell metacharacters to inject arbitrary commands.\nThe attack flow requires an authenticated user to invoke the vulnerable API endpoint with a specially crafted path containing shell metacharacters. When the server processes the request, the underlying system executes the concatenated shell command, causing the injected payload to run with the privileges of the application process.\nPrerequisites for this attack include authentication and the assignment of the specific traefikFiles.read permission. The impact of successful exploitation is critical, resulting in arbitrary code execution and full system compromise on the managed server."
}