Dokploy versions prior to 0.29.13 contain a critical OS command injection vulnerability that allows authenticated users to achieve arbitrary command execution on the host system.

The vulnerability resides in the backup.restoreBackupWithLogs tRPC subscription, where the databaseName parameter is insufficiently sanitized before being passed to shell commands. This allows an authenticated attacker with specific permissions to escape the intended context and execute commands with the privileges of the host Docker container.

This vulnerability allows for privilege escalation and full system compromise, as an authenticated attacker can execute arbitrary commands in the host environment. With a CVSS score of 9.9, this represents a severe threat to the security of the entire PaaS infrastructure managed by Dokploy, potentially enabling lateral movement across the network.

Immediate Action: Update the Dokploy installation to version 0.29.13 or later immediately.

Proactive Monitoring: Audit logs for the backup and restore processes to identify any unusual input strings or unexpected shell command execution patterns.

Compensating Controls: Enforce strict access control policies to limit the number of users with the backup:restore permission until the patch can be successfully deployed.

Public Exploit Available: No confirmed public exploit available.

The severity of this command injection flaw mandates an immediate update to version 0.29.13. Security teams should verify that all instances of Dokploy are updated and review the permissions of all users within the platform to minimize the attack surface until the remediation is confirmed.