CyberRota Analysis
AI-GeneratedDokploy versions prior to 0.29.13 are vulnerable to command injection due to improper handling of user-controlled Traefik configuration, allowing attackers to execute arbitrary commands on remote servers with the privileges of the configured SSH user. This critical vulnerability poses a significant risk to any organization using affected versions, particularly those managing sensitive deployments or infrastructure through Dokploy. Users should prioritize upgrading to version 0.29.13 or later to mitigate this severe security threat.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed through execAsyncRemote. Single quotes in redirect regex and replacement fields, basic authentication usernames, domain host values, or middleware configuration can terminate the shell quoting and execute arbitrary commands on managed remote servers with the configured SSH user's privileges. This vulnerability is caused by an incomplete fix for CVE-2026-45630. This issue is fixed in version 0.29.13.