This critical OS command injection vulnerability in Dokploy allows an authenticated administrator to execute arbitrary commands on the host server, leading to full system compromise.

The vulnerability exists in the backup and restore pipeline, where user-controlled database fields are improperly sanitized before being passed to system shell execution functions, allowing for command injection by an authenticated user with administrative privileges.

With a CVSS score of 9.6, this vulnerability poses a severe threat to infrastructure. Because the commands execute on the host machine rather than within a container, an attacker can escape the application environment to gain full control of the underlying host operating system, resulting in total loss of confidentiality and integrity.

Immediate Action: Upgrade Dokploy to version 0.29.13 or later to implement secure command handling and input sanitization.

Proactive Monitoring: Audit logs for suspicious shell process execution or unexpected child processes spawning from the Dokploy service.

Compensating Controls: Ensure that the Dokploy service is running with the least privilege necessary, and consider implementing host-based intrusion detection systems to alert on unauthorized command execution.

Public Exploit Available: Unknown

Administrators should treat this as a high-urgency update. Patching the application to version 0.29.13 is the only effective way to remediate the unsafe command interpolation within the backup and restore pipeline.