A critical OS command injection flaw in Dokploy allows authenticated users to execute arbitrary commands on the host server, resulting in total system compromise.

The vulnerability resides in the backup.listBackupFiles tRPC endpoint, which fails to properly sanitize the search parameter before passing it to an OS command. This allows an authenticated user with backup read permissions to perform command injection on the host.

Successful exploitation grants an attacker the ability to execute arbitrary commands on the host server, effectively bypassing application-level security. This can lead to full server compromise, data exfiltration, and lateral movement within the network. The 9.9 CVSS score highlights the severity of this remote code execution risk.

Immediate Action: Update Dokploy to version 0.29.13 or later to implement the necessary command sanitization.

Proactive Monitoring: Monitor server logs for shell-related commands originating from the Dokploy process and look for anomalous file system interactions.

Compensating Controls: Restrict access to the backup management features and implement egress filtering to prevent the server from reaching unauthorized external hosts.

Public Exploit Available: No (unknown)

Immediate patching is required to eliminate this command injection risk. Administrators should also review logs for any evidence of unauthorized backup file access or suspicious command execution since the deployment of the affected versions.