An authenticated command injection vulnerability in Dokploy allows a user with project access to gain full control over the underlying host operating system.

The application fails to properly sanitize input within the getRegistryCommands function, which interpolates registry credentials directly into a shell command. An authenticated attacker can leverage this by providing malicious credentials to trigger arbitrary command execution on the host server.

This vulnerability carries a CVSS score of 9.4, reflecting its critical severity. Successful exploitation allows an attacker to gain unauthorized access to the server, modify host files, and potentially compromise other containers managed by the platform. This leads to a total loss of confidentiality, integrity, and availability for the affected infrastructure.

Immediate Action: Update Dokploy to version 0.29.8 or later immediately to apply the necessary input sanitization fixes.

Proactive Monitoring: Review system logs for suspicious shell activity or unexpected processes initiated by the Dokploy service user.

Compensating Controls: Restrict access to the platform to trusted users only, and employ network segmentation to limit the potential blast radius of a compromised container host.

Public Exploit Available: Unknown

Given the critical severity of this OS command injection vulnerability, administrators should prioritize patching their Dokploy instances. Applying version 0.29.8 or higher is essential to prevent unauthorized system access and potential full host compromise.