A critical OS command injection vulnerability in Dokploy allows authenticated attackers to execute arbitrary system commands, potentially leading to full system compromise.

The application fails to properly neutralize special elements used in OS commands, resulting in a command injection flaw. This vulnerability requires the attacker to have low privileges (authenticated) to trigger the malicious payload.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands with the privileges of the application process. Given the CVSS score of 8.7, this represents a significant risk of unauthorized access, potential data exfiltration, and complete loss of control over the PaaS environment.

Immediate Action: Upgrade to Dokploy version 0.29.13 or later to resolve the underlying command injection flaw.

Proactive Monitoring: Monitor server access logs for unusual command patterns or unexpected process execution requests originating from the Dokploy service account.

Compensating Controls: Implement strict network segmentation and egress filtering to limit the potential impact if the application is compromised.

Public Exploit Available: No (exploit_available: false)

The severity of this flaw necessitates immediate attention. Administrators should verify their current deployment version and apply the patch to 0.29.13 or higher immediately to mitigate the risk of command injection.