An OS command injection vulnerability in Dokploy allows authenticated attackers to execute arbitrary system commands, posing a critical risk to host integrity.

The application fails to properly neutralize special elements in OS commands (CWE-78). This allows an authenticated user to bypass security controls and execute arbitrary commands on the underlying server.

This vulnerability provides a pathway for an authenticated attacker to gain full control over the host server. Given the CVSS score of 8.7, it is critical to address this to prevent unauthorized access, data theft, and potential ransomware deployment.

Immediate Action: Upgrade to Dokploy version 0.29.13, which contains the upstream fix for this command injection vulnerability.

Proactive Monitoring: Monitor server logs for unauthorized command execution patterns or anomalous outbound network connections from the Dokploy host.

Compensating Controls: Implement strict ingress filtering and monitor for unusual input strings in application fields that interact with system-level commands.

Public Exploit Available: No (exploit_available: false)

Administrators must update to version 0.29.13 immediately to resolve this vulnerability. Continued operation of older versions exposes the host environment to significant risk of unauthorized command execution and system takeover.