Executive brief
Dokploy is an open-source Platform as a Service (PaaS) tool that allows users to self-host and manage applications and services. A critical vulnerability in how Dokploy processes Traefik proxy configurations allows attackers to execute arbitrary commands on remote servers managed by Dokploy. An attacker who can modify application configuration settings (such as redirect rules, authentication credentials, or domain names) can inject shell metacharacters to break out of intended quoting and run malicious code with the privileges of the SSH user connecting to those servers.
Technical details
The vulnerability is a shell command injection flaw in the writeTraefikConfigRemote function within packages/server/src/utils/traefik/application.ts. The code serializes user-controlled Traefik configuration using yaml.stringify and directly interpolates the resulting YAML string into an echo command executed via SSH (execAsyncRemote). Single quotes in redirect regex/replacement fields, basic authentication usernames, domain host values, or middleware configuration are not properly escaped, allowing attackers to terminate the shell quoting and inject arbitrary shell commands. An authenticated attacker with the ability to modify application configuration can exploit this to achieve remote code execution on managed servers with the privileges of the configured SSH user. This is a regression—an incomplete fix for CVE-2026-45630. The patch in version 0.29.13 base64-encodes the remote Traefik YAML and escapes config paths to prevent command injection.
Affected products
- Dokploy Dokploy before 0.29.13
Timeline
- 2026-08-10: disclosed
- 2026-07-21: patched: Version 0.29.13 released with fix