Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy's backup and restore pipeline constructs shell commands by directly interpolating user-controlled database fields into bash -c "..." and sh -c "..." strings, then executes them via child_process.exec(). An authenticated admin/owner can inject arbitrary OS commands that execute on the host machine running Dokploy (not just inside a container). This vulnerability is fixed in 0.29.13.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-10T20:17:34.277Z",
  "pubdate": "2026-08-10T20:17:34.277Z",
  "executiveSummary": "Dokploy versions prior to 0.29.13 contain a critical Remote Code Execution vulnerability within its backup and restore pipeline. The flaw stems from insecure handling of user-controlled database fields that are directly interpolated into shell command strings and subsequently executed via the child_process.exec() function. This vulnerability allows an authenticated attacker with administrative or owner privileges to inject arbitrary operating system commands, leading to full system compromise. Because Dokploy executes these commands on the host machine rather than strictly within an isolated containerized environment, successful exploitation grants the adversary complete administrative control over the underlying host infrastructure. The risk implication is severe, enabling attackers to pivot, exfiltrate sensitive data, or disrupt core services. Mitigation requires upgrading Dokploy to version 0.29.13 or later, where proper input sanitization and secure process execution mechanisms have been implemented to neutralize command injection vectors.",
  "technicalDetails": "The vulnerability resides in the backup and restore pipeline of Dokploy prior to version 0.29.13. The root cause of the issue is improper neutralization of special elements used in an OS command, commonly classified as OS Command Injection. Specifically, the application extracts user-controlled fields directly from database records and constructs shell command strings utilizing bash -c and sh -c wrappers without adequate parameterization, validation, or sanitization. These dynamically generated command strings are subsequently handed over to the Node.js child_process.exec() execution sink.\nExploitation of this flaw requires authentication with administrative or owner privileges within the Dokploy platform. An attacker leverages this access to modify or inject malicious payloads into database fields that are later processed by the backup and restore routines. When the backup or restore pipeline is triggered, the interpolated strings are evaluated by the underlying shell, allowing the attacker to break out of the intended command context and execute arbitrary operating system commands.\nThe attack flow proceeds as follows: First, the authenticated attacker creates or modifies a database record containing malicious shell metacharacters and operating system commands within fields utilized by the backup or restore logic. Second, the user initiates or schedules a backup or restore operation. Third, the backend reads the affected database fields and unsafely interpolates them into a bash -c or sh -c command string. Fourth, child_process.exec() spawns a shell to execute the concatenated command string on the host machine. Finally, the injected commands execute with the full privileges of the Node.js process running Dokploy on the host.\nThe post-exploitation impact is severe. Because the execution occurs directly on the host machine hosting the PaaS solution rather than within a restricted container boundary, the adversary achieves full host system compromise. This permits unauthorized access to sensitive environment variables, persistent backdoor installation, lateral movement across connected networks, and full administrative dominion over the underlying infrastructure."
}