VulnerabilityPublished 17 Sep 2026

VU#280377: Dokploy is vulnerable to OS command injection

Source CERT/CC

Fixed in 0.29.13 : patch affected systems as a priority.

Data as of 17 Sep 2026, 15:15 UTC

Severity

Critical

Rated Critical by Threat Radar from the CERT/CC text

Patch: Available – fixed in 0.29.13

What to do

AI-suggested

A fix is available in Dokploy version 0.29.13 and later; users should update immediately. For those unable to update promptly, it is recommended to disable default backup permissions or restrict them strictly to necessary users and roles to reduce the risk of exploitation.

Description

Dokploy versions 0.29.8 and 0.29.11, as well as commit 24b02f5 on the canary branch, contain an OS command injection vulnerability in their database backup creation and restoration processes. This occurs because user-supplied input is unsafely incorporated into shell commands executed with root privileges. Authenticated users with backup permissions can exploit this to execute arbitrary commands as root, potentially leading to full system compromise. The vulnerability affects all supported database types: PostgreSQL, MySQL, MariaDB, MongoDB, and LibSQL. The issue has been patched in Dokploy version 0.29.13 and later. Users unable to update should restrict backup permissions to mitigate risk.

Impact

An authenticated Dokploy user with backup permissions can execute arbitrary commands with root privileges on the Dokploy host. This can lead to full system compromise, including persistent read/write access to the filesystem and theft of private credentials for other tenants managed by the same Dokploy instance. The vulnerability affects all supported database types, increasing the attack surface.

Summary

Dokploy is an open-source Platform as a Service for deploying applications and databases on self-hosted servers. Versions 0.29.8, 0.29.11, and commit 24b02f5 on the canary branch are vulnerable to OS command injection due to insufficient sanitization of user input in shell commands used for database backup creation and restoration. The vulnerable parameters (database name and backupFile) are passed to a shell execution helper invoking /bin/bash without escaping or restrictions on shell metacharacters. Since the Dokploy process runs with root privileges by default, an authenticated user with backup permissions can execute arbitrary commands as root on the host. This grants full control over the host, including filesystem access and the ability to steal credentials for other tenants. The vulnerability affects all five supported database types. The vulnerability has been patched in version 0.29.13 and later. No vendor statement was available, but CERT/CC recommends immediate updating. As a temporary mitigation, administrators should disable or restrict backup permissions to necessary users only.

References

kb.cert.org/vuls/id/280377 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 17 Sep 2026, 15:15 UTC

References

Community reviews