Executive brief
Dokploy is a self-hosted platform-as-a-service (PaaS) system that deploys and manages applications using Docker. A vulnerability in versions before 0.29.13 allows attackers to execute arbitrary commands on the Docker host by deploying a malicious compose configuration with specially crafted names or service definitions that break out of the shell command being constructed.
Technical details
The vulnerability is a shell command injection flaw in the createCommand() function, which constructs docker compose commands by directly interpolating user-controlled compose service names and configuration values into bash command strings. An attacker can inject shell metacharacters (such as semicolons, pipes, or command substitution) into compose names or service definitions; when the malicious compose is deployed, these characters are interpreted as command separators rather than literal strings, allowing arbitrary command execution on the host running the Docker daemon. The vulnerability requires authentication and ability to deploy a compose application. The fix in version 0.29.13 applies proper shell escaping using the shell-quote library and validates custom compose commands to reject shell control characters.
Affected products
- Dokploy Dokploy before 0.29.13
Timeline
- 2026-08-10: disclosed
- 2026-07-19: patched: Fix released in version 0.29.13 on July 21, 2026