A critical command injection vulnerability in Dokploy allows low-privileged users to achieve full administrative control over the host system.

The application incorrectly handles user-supplied input when performing test connections for cloud storage destinations. A low-privileged member can bypass authorization checks to execute arbitrary commands on the host container, which holds dangerous access to the host Docker socket.

With a CVSS score of 9.9, this vulnerability poses an extreme risk to the entire infrastructure. Because the Dokploy container has access to the host Docker socket, an attacker can escape the container, compromise the host operating system, and potentially gain access to all other containers managed by the host.

Immediate Action: Upgrade Dokploy to version 0.29.13 or later immediately to patch the command injection vector.

Proactive Monitoring: Review audit logs for unusual command executions or unexpected processes spawning from the Dokploy service. Monitor for unauthorized creation of new containers or modification of existing ones.

Compensating Controls: Run the Dokploy container with the least privilege necessary and avoid mounting the Docker socket unless absolutely required. Implement network segmentation to isolate the PaaS environment from sensitive internal systems.

Public Exploit Available: Unknown.

This vulnerability represents a critical security failure. Administrators must update to 0.29.13 immediately to neutralize the risk of full infrastructure compromise.