Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server because registry.testRegistry and registry.testRegistryById in apps/dokploy/server/api/routers/registry.ts interpolate the password field into an execAsyncRemote shell command instead of using safeDockerLoginCommand. This issue is fixed in version 0.29.13.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-10T20:17:35.707Z",
  "pubdate": "2026-08-10T20:17:35.707Z",
  "executiveSummary": "A critical remote command execution vulnerability has been identified in Dokploy prior to version 0.29.13. The vulnerability stems from improper neutralization of special elements used in an OS command within the registry management API routes. Specifically, the registry.testRegistry and registry.testRegistryById functions directly interpolate user-supplied authentication parameters into shell execution routines instead of invoking secure abstraction layers like safeDockerLoginCommand.\nAn authenticated attacker with access to the registry configuration interface can exploit this flaw to inject arbitrary shell commands. Successful exploitation results in remote code execution on the local host or any SSH-connected target server managed by the platform. Given that Dokploy operates as a self-hostable Platform as a Service (PaaS) with administrative control over deployment infrastructure, this vulnerability severely compromises the confidentiality, integrity, and availability of the underlying operating system and hosted applications.\nThe attack requires prior authentication to the Dokploy application, after which the malicious payload can be delivered through standard API requests interacting with registry testing functionalities. The issue has been fully addressed and remediated in version 0.29.13 through the adoption of safe command construction methodologies.",
  "technicalDetails": "The root cause of this vulnerability lies in improper input sanitization and unsafe command interpolation within the backend API routing logic of Dokploy. Specifically, the vulnerable component is located in apps/dokploy/server/api/routers/registry.ts, within the registry.testRegistry and registry.testRegistryById functions.\nDuring the execution of registry connection validation routines, the application constructs a shell command to test registry authentication parameters. Instead of utilizing the secure safeDockerLoginCommand utility function designed to prevent command injection, the application directly interpolates the password field into the execAsyncRemote shell command execution pipeline. Because the input is passed directly to the underlying shell without adequate escaping or parameterization, an attacker can append shell metacharacters such as semicolons, pipes, or backticks to break out of the intended argument context and execute arbitrary system commands.\nThe attack flow proceeds as follows: First, the adversary authenticates to the Dokploy platform. Second, the attacker crafts a malicious API request targeting the registry testing endpoints, embedding shell command payloads within the password parameter. Third, the backend application processes the request, interpolates the tainted password field into the execAsyncRemote function, and dispatches the resulting command string to the local system or an SSH-connected target server. Finally, the operating system executes the injected commands with the privileges of the Dokploy backend process, granting the adversary immediate code execution capabilities.\nThe vulnerability affects Dokploy versions prior to 0.29.13. Exploitation requires authenticated access to the platform and the ability to interact with registry configuration features. Depending on the deployment architecture, the resulting impact includes full system compromise, lateral movement within SSH-connected target nodes, and unauthorized access to sensitive deployment environments."
}