VU#280377: Dokploy is vulnerable to OS command injection
CERT/CC details an OS command injection in Dokploy letting authenticated users execute commands as root; patched in 0.29.13.
CERT/CC VU#280377 describes an OS command injection in Dokploy's database backup creation and restoration, caused by unsanitized user input interpolated into shell commands run via /bin/bash. Authenticated users with default backup permissions can execute arbitrary commands with root privileges, gaining full host control and access to other tenants' stored credentials. Versions 0.29.8, 0.29.11, and canary commit 24b02f5 were confirmed vulnerable across all five supported databases; the vendor was unresponsive, and fixes shipped in versions 0.29.13 and later.
- Command injection in backup/restore passes unsanitized input directly to /bin/bash
- Authenticated users with default backup permissions gain root command execution
- Affects PostgreSQL, MySQL, MariaDB, MongoDB, and LibSQL deployments
- Patched in Dokploy 0.29.13+; vendor did not respond to CERT/CC coordination
- Mitigation: disable default backup permissions and restrict them to necessary roles
From the original article
2 min read at kb.cert.orgOverview Dokploy versions 0. 29. 8 and 0.
kb.cert.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.