Dokploy v0.31.0 password change yields host RCE via backtick
Original title: Dokploy: the validator allows the backtick — a member's database password change is host RCE, 9.9 on the vendor's own vector (v0.31.0, live-proven)
A member changing a database password can reach host command execution; the researcher live-tested the official v0.31.0 image.
A post to oss-security says Dokploy's validator accepts a backtick, so a member's database password change becomes host remote code execution. The reporter tested the official dokploy/dokploy v0.31.0 image and cites 9.9 on the vendor's own vector. Dokploy is described as a self-hosted panel with root on managed servers, the Docker socket, and deployed application credentials. No fix is stated in the available text.
Unconfirmed: The 9.9 score is the poster's use of the vendor vector, and the snippet does not state a fixed version or vendor confirmation.
- Tested against official dokploy/dokploy v0.31.0.
- The password validator allows a backtick.
- A member database password change becomes host RCE.
- The poster cites 9.9 on the vendor's own vector.
- The project has 38,000 stars and 514 official templates.
Impact: Member password change yields host command execution
| Product | Affected |
|---|---|
| dokploy | v0.31.0 |
- Vendors
- Dokploy
From the original article
Posted by theknell on Nov 09 Dokploy's pitch is a self-hosted panel that holds the keys to everything it manages: root on every server in the fleet, the Docker socket, and the credentials of every database and application it deploys. 38,000 stars, 514 official templates. The panel is, by design, the most trusted process on the host.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.