Executive brief
Dokploy, a self-hostable platform for managing applications and containers, contains a security flaw in its file upload system. An authorized user can bypass security restrictions to execute unauthorized commands on the underlying server hosting the platform. This could allow an attacker to take full control of the server, access sensitive data across all hosted applications, or disrupt services.
Technical details
A command injection vulnerability exists in the 'uploadFileToContainer' endpoint within Dokploy's Docker router. The 'destinationPath' parameter is directly interpolated into a shell command string used for 'docker cp' operations without proper sanitization or neutralization of shell metacharacters. An authenticated attacker can provide a malicious path containing characters like ';' or '"' to escape the intended command and execute arbitrary code with the privileges of the Dokploy process. The vulnerability is located in 'apps/dokploy/server/api/routers/docker.ts' and 'packages/server/src/services/docker.ts'. As of the advisory date, no official patch is listed, though remediation involving 'execFile' and strict regex validation is recommended.
Affected products
- Dokploy Dokploy <= 0.29.1
Timeline
- 2026-05-11: advisory: GitHub Security Advisory published by maintainer
- 2026-05-29: disclosed: CVE published to NVD