A critical OS command injection vulnerability in Dokploy allows authenticated users to execute arbitrary commands on the host operating system with elevated privileges.

The application fails to properly sanitize the composePath variable before passing it to system shell commands. An authenticated user with sufficient permissions can inject malicious payloads into this path, resulting in arbitrary OS command execution within the context of the Dokploy host.

With a CVSS score of 9.9, this vulnerability allows for full system compromise. An attacker who successfully exploits this flaw can gain persistent access to the host server, modify system configurations, and pivot into other parts of the internal network, posing a catastrophic risk to organizational security.

Immediate Action: Update the Dokploy installation to version 0.29.13 to implement input validation and secure command execution practices.

Proactive Monitoring: Monitor server logs for suspicious command-line activity or child processes spawned by the Dokploy service that deviate from normal operational baselines.

Compensating Controls: Implement strict file system permissions for the user account running the Dokploy service to limit the impact of potential command execution.

Public Exploit Available: No

This is a critical security flaw that enables complete host takeover. Given the ease of triggering this via the compose update functionality, all instances should be patched to version 0.29.13 without delay.