An OS command injection vulnerability in Dokploy allows authenticated attackers to execute arbitrary system commands during database service deployment, risking full server compromise.

This vulnerability involves improper neutralization of special elements used in an OS command (CWE-78). The software fails to properly quote user-controlled input for the dockerImage field before passing it to shell commands, allowing an authenticated attacker to inject arbitrary system commands.

Successful exploitation allows an authenticated user to gain code execution on the underlying host server. Because the affected functions are used for infrastructure deployment, an attacker could escalate privileges or gain persistent access to the server environment. This vulnerability is highly dangerous, as evidenced by its 9.9 CVSS score, which reflects the potential for complete system compromise.

Immediate Action: Upgrade to Dokploy version 0.29.13 or later, which includes the necessary fixes to properly quote and sanitize input for container deployment commands.

Proactive Monitoring: Monitor server logs for unexpected shell activity or unauthorized container deployment attempts originating from the Dokploy administrative interface.

Compensating Controls: Implement network segmentation to isolate the Dokploy management interface and restrict access to only trusted administrative users.

Public Exploit Available: Unknown

Given the high CVSS score and the nature of the vulnerability, administrators should treat this as a high-priority update. Ensure that all Dokploy instances are updated to version 0.29.13 and audit user access logs to ensure no unauthorized activity occurred prior to the patch.