Dokploy is an open-source Platform as a Service for deploying applications and databases on self-hosted servers. Versions 0.29.8, 0.29.11, and commit 24b02f5 on the canary branch are vulnerable to OS command injection due to insufficient sanitization of user input in shell commands used for database backup creation and restoration. The vulnerable parameters (database name and backupFile) are passed to a shell execution helper invoking /bin/bash without escaping or restrictions on shell metacharacters. Since the Dokploy process runs with root privileges by default, an authenticated user with backup permissions can execute arbitrary commands as root on the host. This grants full control over the host, including filesystem access and the ability to steal credentials for other tenants. The vulnerability affects all five supported database types. The vulnerability has been patched in version 0.29.13 and later. No vendor statement was available, but CERT/CC recommends immediate updating. As a temporary mitigation, administrators should disable or restrict backup permissions to necessary users only.

An authenticated Dokploy user with backup permissions can execute arbitrary commands with root privileges on the Dokploy host. This can lead to full system compromise, including persistent read/write access to the filesystem and theft of private credentials for other tenants managed by the same Dokploy instance. The vulnerability affects all supported database types, increasing the attack surface.

A fix is available in Dokploy version 0.29.13 and later; users should update immediately. For those unable to update promptly, it is recommended to disable default backup permissions or restrict them strictly to necessary users and roles to reduce the risk of exploitation.