CyberRota Analysis
AI-GeneratedDocker users deploying Dokploy versions prior to 0.29.13 are vulnerable to arbitrary command execution due to improper handling of shell command construction in the createCommand() function. Maliciously crafted service names or definitions can exploit this flaw, potentially compromising the Docker host. Organizations utilizing Dokploy should prioritize upgrading to version 0.29.13 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the createCommand() function constructs shell commands by interpolating compose service names and configuration into bash command strings. When a compose with a maliciously crafted name or service definition is deployed, the shell metacharacters are interpreted as command separators, allowing arbitrary command execution on the Docker host. This vulnerability is fixed in 0.29.13.