An authenticated OS command injection vulnerability in Dokploy versions prior to 0.29.13 allows attackers to execute arbitrary code on target servers, posing a critical risk to system integrity.

This vulnerability is an OS command injection flaw (CWE-78) occurring because the application improperly interpolates user-controlled password fields into shell commands. Exploitation requires the attacker to have an authenticated session.

Successful exploitation grants an attacker the ability to execute arbitrary commands with the privileges of the Dokploy service. Given the CVSS score of 9.9, this vulnerability could lead to total system compromise, unauthorized data access, and the potential for lateral movement within the infrastructure.

Immediate Action: Upgrade the Dokploy instance to version 0.29.13 or later immediately.

Proactive Monitoring: Monitor server logs for suspicious shell commands or anomalous process execution originating from the Dokploy service account.

Compensating Controls: Ensure the Dokploy service runs with the least privilege necessary, and utilize network segmentation to limit the impact if the host is compromised.

Public Exploit Available: No (exploit_available: false)

The critical severity of this vulnerability necessitates immediate patching. Organizations should prioritize updating to version 0.29.13 to prevent potential remote code execution and maintain the security posture of their deployment environments.