Executive brief
Dokploy is a self-hostable platform used to manage and deploy applications. A security flaw allows an authenticated user to execute unauthorized commands on the underlying server by providing a specially crafted web address when configuring a container registry. This could lead to a total takeover of the server, exposure of sensitive application data, and disruption of all hosted services.
Technical details
A command injection vulnerability exists in Dokploy versions 0.29.0 and earlier within the `deleteRegistry` function located in `packages/server/src/services/registry.ts`. The application fails to apply shell escaping (via the existing `shEscape()` utility) to the `registryUrl` parameter before passing it to a `docker logout` command executed via `execAsync`. An authenticated attacker can exploit this by creating a registry entry with a malicious URL containing shell metacharacters (e.g., semicolons or backticks) and subsequently deleting that entry. This results in Remote Code Execution (RCE) with the privileges of the Dokploy server process, potentially leading to full host compromise via the Docker daemon.
Affected products
- Dokploy Dokploy <= 0.29.0
Timeline
- 2026-05-11: advisory: GitHub security advisory published by maintainers
- 2026-05-29: disclosed: NVD publication date