Insufficient input validation in Dokploy allows authenticated users to trigger OS command injection by supplying malicious input to Git branch configuration fields.

This issue stems from an incomplete fix for a previous vulnerability, where server-side validation is missing for various Git branch parameters. An authenticated user can inject malicious characters into these fields, which are subsequently passed to shell-based Git commands, leading to arbitrary OS command execution on the host.

The vulnerability carries a CVSS score of 9.9, indicating critical severity. Successful exploitation permits an attacker to execute commands with the privileges of the Dokploy service, potentially leading to full server compromise, data theft, and the destruction of deployment environments.

Immediate Action: Upgrade to Dokploy version 0.29.13, which includes the necessary server-side validation to prevent command injection.

Proactive Monitoring: Audit configuration changes related to Git branches and monitor for unusual Git-related process execution on the host system.

Compensating Controls: Use Web Application Firewalls (WAF) to inspect and block requests containing meta-characters or shell command syntax in branch name fields if patching is delayed.

Public Exploit Available: No

This vulnerability is a significant risk that could lead to total system compromise. Administrators must apply the version 0.29.13 update immediately to ensure robust input validation is enforced across all Git-related deployment functions.