Executive brief
Dokploy is a self-hosted platform-as-a-service tool used to deploy and manage applications. The backup and restore feature allows authenticated users with specific permissions to restore database backups, but it fails to safely validate user inputs. An attacker with backup-restore permissions can inject shell commands through database names or backup file paths, leading to arbitrary code execution on the host server running Dokploy.
Technical details
This is an OS command injection vulnerability (CWE-78) in the backup.restoreBackupWithLogs tRPC subscription. The vulnerability exists in multiple database restore utilities (postgres.ts, mysql, mariadb, mongo, libsql) where user-controlled databaseName and backupFile parameters are interpolated directly into shell commands without proper escaping. The commands are executed via execAsync or execAsyncRemote, which pass them to a shell running in the Dokploy host context. The attack vector is network-based through the tRPC subscription endpoint, requiring authentication with backup-restore permission. An attacker can achieve remote code execution even when no valid database container or backup file exists. The vulnerability was patched in version 0.29.13 by passing database identifiers via environment variables instead of shell interpolation.
Affected products
- Dokploy Dokploy before 0.29.13
Timeline
- 2026-08-10: disclosed
- 2026-07-19: patched: Fixed in version 0.29.13