Executive brief
Dokploy is a self-hosted platform-as-a-service tool that allows teams to deploy applications and services. Prior to version 0.29.13, the database deployment functions (PostgreSQL, MySQL, MariaDB, MongoDB, Redis, and LibSQL) were vulnerable to command injection because user-supplied Docker image names were not properly escaped before being passed to shell commands executed on remote servers. An attacker with platform access could inject arbitrary shell commands through a crafted Docker image name, potentially compromising the entire deployment infrastructure and gaining unauthorized access to deployed databases and applications.
Technical details
This is an OS command injection vulnerability (CWE-78) in the database service deployment functions for Dokploy. The vulnerable code in mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts passed user-controlled dockerImage field values directly into shell commands via string interpolation (docker pull ${dockerImage}) without proper escaping or quoting, then executed these commands on remote servers using execAsyncRemote (SSH). An authenticated attacker with permissions to deploy database services can exploit this by providing a malicious Docker image name containing shell metacharacters (e.g., '; rm -rf /') to execute arbitrary commands on the remote server. The fix, released in version 0.29.13, applies proper shell escaping using the shell-quote library to safely quote the dockerImage parameter before shell execution.
Affected products
- Dokploy Dokploy before 0.29.13
Timeline
- 2026-08-10: disclosed
- 2026-07-19: patched: Fix released in version 0.29.13