{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/280377#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nDokploy versions 0.29.8 and 0.29.11, as well as commit *24b02f5* on the canary branch, are vulnerable to OS command injection during the backup creation and restoration processes. The vulnerability stems from unsanitized shell command construction that can allow an attacker to escalate privileges and lead to full compromise of the target device.\r\n\r\n### Description\r\nDokploy is an open-source Platform as a Service solution for deploying applications and databases on self-hosted servers. Dokploy allows authenticated users to create and schedule database backups and restore previously created backups. These backup operations are executed by the Dokploy process, which runs with root privileges by default.\r\n\r\nDokploy is vulnerable to OS command injection in its database backup creation and restoration functionality due to insufficient sanitization of user-controlled input before it is incorporated into shell commands. The vulnerable backup functionality constructs database-specific shell commands that directly interpolate a user-supplied database name, while the restore functionality incorporates a user-supplied `backupFile` value into a shell command. Both operations ultimately pass the resulting command to a shell execution helper that invokes `/bin/bash` as a child of the Dokploy process, without shell escaping or restrictions on shell metacharacters.\r\n\r\nThe affected parameters are exposed through `tRPC` procedures that only validate that the supplied values are non-empty strings. Consequently, authenticated users with permission to perform database backups can supply shell metacharacters that are interpreted by `/bin/bash`, resulting in arbitrary command execution on the Dokploy host with the root privileges of the Dokploy server process.\r\n\r\n### Impact\r\nAn attacker with authenticated Dokploy account with backup permission (granted by default for database services) can execute arbitrary commands as **root**  (default configuration) on the Dokploy host. Successful exploitation provides full control of the host, including persistent read/write access to the target server's filesystem and the ability to steal private credentials stored for other tenants managed by the same Dokploy instance.\r\nThe vulnerability affects all five database types supported by Dokploy: PostgreSQL, MySQL, MariaDB, MongoDB, and LibSQL. Exploitation was confirmed against versions 0.29.8 and 0.29.11, as well as commit *24b02f5* on the canary branch available on GitHub.\r\n\r\n### Solution\r\nUnfortunately, Dokploy could not be reached to coordinate this vulnerability; however, the issue has been patched in Dokploy versions 0.29.13 and beyond. The CERT/CC recommends users update immediately. Database administrators or general operators unable to update should mitigate potential attacks by turning off default backup permissions, and restricting these permissions only to necessary users and roles.\r\n\r\n### Acknowledgements\r\nThanks to Muhammadjon Ahmadjonov for reporting this vulnerability. This document was written by Alex Lewis.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/280377"},{"url":"https://github.com/Dokploy/dokploy/blob/canary/packages/server/src/utils/backups/utils.ts","summary":"https://github.com/Dokploy/dokploy/blob/canary/packages/server/src/utils/backups/utils.ts"},{"url":"https://github.com/Dokploy/dokploy/blob/canary/packages/server/src/utils/restore/libsql.ts","summary":"https://github.com/Dokploy/dokploy/blob/canary/packages/server/src/utils/restore/libsql.ts"},{"url":"https://github.com/Dokploy/dokploy/blob/canary/packages/server/src/utils/process/execAsync.ts","summary":"https://github.com/Dokploy/dokploy/blob/canary/packages/server/src/utils/process/execAsync.ts"},{"url":"https://github.com/Dokploy/dokploy/commit/ccd2e83c5","summary":"https://github.com/Dokploy/dokploy/commit/ccd2e83c5"}],"title":"Dokploy is vulnerable to OS command injection","tracking":{"current_release_date":"2026-09-17T15:02:59+00:00","generator":{"engine":{"name":"VINCE","version":"3.0.48"}},"id":"VU#280377","initial_release_date":"2026-09-17 15:02:59.624573+00:00","revision_history":[{"date":"2026-09-17T15:02:59+00:00","number":"1.20260917150259.1","summary":"Released on 2026-09-17T15:02:59+00:00"}],"status":"final","version":"1.20260917150259.1"}},"vulnerabilities":[{"title":"Dokploy version 0.","notes":[{"category":"summary","text":"Dokploy version 0.29.11 is vulnerable to OS command injection, allowing an authenticated user with database backup permissions to escalate privileges to root and execute arbitrary commands."}],"ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#280377"}]}],"product_tree":{"branches":[]}}