Executive brief
Dokploy is a self-hosted Platform-as-a-Service (PaaS) platform that allows users to deploy and manage applications. Prior to version 0.29.13, the platform failed to properly escape user-controlled input when executing shell commands for Docker Swarm cluster management and container registry operations, allowing attackers to inject arbitrary OS commands and gain control of the system running Dokploy.
Technical details
The vulnerability is an OS command injection flaw (CWE-78) in Dokploy's registry credential testing and Docker Swarm cluster management endpoints. User-controlled values (nodeId, registryTag, imageName) are interpolated directly into shell commands via unquoted template literals and passed to remote execution via SSH (execAsyncRemote), bypassing the safer local execution paths (execFileAsync or Docker API). The vulnerable endpoints include cluster.removeWorker, swarm image upload (getRegistryCommands), and registry testing functionality. An authenticated attacker can inject shell metacharacters and arbitrary commands that execute with the privileges of the Dokploy process. The vulnerability is fixed in version 0.29.13 by applying shell-quoting to all user-controlled values before command interpolation.
Affected products
- Dokploy Dokploy prior to 0.29.13
Timeline
- 2026-08-10: disclosed
- 2026-07-19: patched: Fix released in version 0.29.13 on July 21, 2026