Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated low-privilege member to execute arbitrary commands on the control-plane host because the volumeName field accepted by volumeBackup.create and volumeBackup.runManually is interpolated without quoting in packages/server/src/utils/volume-backups/backup.ts and executed through child_process.exec, with Docker socket access making execution host/root-equivalent. This issue is fixed in version 0.29.13.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-10T20:17:35.570Z",
  "pubdate": "2026-08-10T20:17:35.570Z",
  "executiveSummary": "An authenticated low-privilege member in Dokploy prior to version 0.29.13 can execute arbitrary commands on the control-plane host. This vulnerability stems from improper input validation and unsanitized command interpolation within volume backup procedures.\nThe flaw allows attackers to achieve remote code execution on the underlying host system. Because Dokploy operates with Docker socket access, successful exploitation escalates execution to host root-equivalent privileges, compromising the entire PaaS infrastructure.\nThe affected product is Dokploy, specifically versions prior to 0.29.13. The vulnerability requires authentication with low-privilege member access to the platform.\nRisk implications are severe, as unauthorized control-plane access permits complete infrastructure takeover, data exfiltration, and lateral movement across the hosted environment.",
  "technicalDetails": "The root cause of the vulnerability is the unsafe interpolation of user-supplied input into shell execution contexts without proper escaping or quoting. Specifically, the volumeName field accepted by the volumeBackup.create and volumeBackup.runManually procedures is passed directly into system commands.\nThe vulnerable component is located in packages/server/src/utils/volume-backups/backup.ts, where the unsanitized volumeName parameter is processed and subsequently executed through the Node.js child_process.exec function.\nThe attack flow proceeds as follows: an authenticated low-privilege user interacts with the volume backup API endpoints (volumeBackup.create or volumeBackup.runManually). The user supplies a maliciously crafted payload within the volumeName field, designed to break out of the intended argument context using command separators or shell metacharacters.\nBecause the input string is interpolated without quoting, the underlying operating system shell interprets the injected payload as part of the command string during child_process.exec invocation. This results in the execution of arbitrary system commands on the control-plane host.\nExploitation requirements include valid authentication credentials with low-privilege member access to the Dokploy control plane. No complex multi-stage exploitation is required beyond submitting the malicious API request.\nThe post-exploitation impact is critical. Due to Dokploy's architectural reliance on Docker socket access, executing arbitrary commands on the control-plane host grants the attacker root-equivalent capabilities, enabling full container escape, access to host resources, and total compromise of the self-hosted PaaS environment."
}