An authenticated OS command injection vulnerability in Dokploy allows low-privilege users to execute arbitrary code on the control-plane host with root-equivalent privileges.

The application fails to quote the volumeName field when processing backup requests, allowing an attacker to inject shell commands. Because the service has access to the Docker socket, successful exploitation results in execution that is effectively host or root-equivalent.

This vulnerability is rated at 9.9 on the CVSS scale, signifying a critical risk to the host control plane. A successful exploit allows a low-privileged user to break out of the application's intended scope, achieving full system access and potentially compromising all other services running on the host server.

Immediate Action: Update Dokploy to version 0.29.13 or later to ensure proper command argument handling.

Proactive Monitoring: Monitor the control-plane host for unauthorized process execution or unexpected modifications to the Docker environment.

Compensating Controls: Ensure that the Dokploy service runs with the minimum necessary privileges and, where possible, utilize kernel-level security modules like AppArmor or SELinux to restrict potential container escapes.

Public Exploit Available: Unknown

Given the extreme severity and the potential for total control-plane compromise, users must upgrade to version 0.29.13 or later immediately. Failure to patch leaves the host server exposed to trivial command injection attacks by any authenticated user.