Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, an authenticated user who can create or update file mounts for a service can inject shell metacharacters into filePath, causing Dokploy to execute attacker-controlled commands on the configured remote managed server over SSH. In the default deployment model, this yields direct remote host RCE from the web interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-10T20:17:34.860Z",
  "pubdate": "2026-08-10T20:17:34.860Z",
  "executiveSummary": "Dokploy versions 0.28.8 and earlier contain a command injection vulnerability stemming from improper input sanitization of the filePath parameter during file mount creation or updates.\nAn authenticated attacker capable of creating or updating file mounts can inject arbitrary shell metacharacters into the filePath input.\nThis vulnerability leads to remote code execution (RCE), allowing the execution of attacker-controlled commands on configured remote managed servers over SSH.\nIn the default deployment model, successful exploitation escalates from an authenticated web interface action to direct remote host RCE.\nThe risk implication is severe, as it permits full compromise of the underlying managed server infrastructure through the administrative web interface.",
  "technicalDetails": "The root cause of the vulnerability lies in insufficient validation and sanitization of user-supplied input passed to the filePath parameter within the file mount management functionality of Dokploy.\nWhen an authenticated user defines or modifies file mounts for a service, the application improperly handles shell metacharacters present within the filePath variable.\nAttackers exploit this flaw by supplying specially crafted payloads containing shell metacharacters inside the filePath field.\nDokploy subsequently passes this unsanitized input to backend execution routines that interact with remote managed servers over SSH, resulting in unintended command execution.\nThe vulnerable component involves the backend handling and processing of service file mounts.\nAffected versions include Dokploy 0.28.8 and all prior versions.\nExploitation requires authentication within the Dokploy web interface, specifically the privilege to create or update file mounts for a service.\nThe attack vector is network-exposed via the web application interface, which then translates into SSH protocol interactions with remote managed servers.\nUpon successful injection, the payload behavior executes arbitrary operating system commands directly on the configured remote host with the privileges of the SSH session managed by the application.\nThe post-exploitation impact includes complete system compromise, unauthorized access to sensitive data, and full control over the remote managed server infrastructure."
}