Executive brief
Dokploy, a self-hostable platform for managing and deploying applications, is vulnerable to a critical security flaw that allows authenticated users to execute arbitrary commands on the host server. By providing a specially crafted application name during setup, an attacker can gain full control over the server with administrative (root) privileges. This could lead to complete data theft, service disruption, or the use of the server for further malicious activities.
Technical details
Dokploy (<= 0.26.6) contains an OS command injection vulnerability due to a failure to properly sanitize the 'appName' parameter. The application uses a 'cleanAppName' function that only replaces spaces and converts text to lowercase, failing to strip shell metacharacters such as semicolons, backticks, and pipes. These unsanitized strings are stored in the database and subsequently interpolated directly into shell commands executed via 'execAsync()' and 'execAsyncRemote()' during service operations (start, stop, remove, scale). An authenticated attacker can exploit this by creating an application with a malicious name and then triggering a service operation, resulting in remote code execution with server-level (root) privileges. The issue is addressed in version 0.26.7 by implementing strict regex validation and parameterized execution.
Affected products
- Dokploy Dokploy <= 0.26.6
Timeline
- 2026-01-31: patched: Fix committed to repository
- 2026-05-11: advisory: GitHub Security Advisory published
- 2026-05-18: disclosed: CVE published to NVD