CyberRota Analysis
AI-GeneratedDokploy versions prior to 0.29.13 are vulnerable due to improper validation of the composePath in the compose.update operation, allowing authenticated users with write and deploy permissions to execute arbitrary commands on the Docker host. This critical vulnerability (CVSS 9.9) can lead to full system compromise, making it imperative for organizations using Dokploy to prioritize upgrading to the patched version. All users of Dokploy should assess their exposure and apply the necessary updates immediately to mitigate potential risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the compose.update operation stores an unvalidated composePath that packages/server/src/utils/builders/compose.ts and packages/server/src/services/compose.ts interpolate into docker compose -f, docker stack deploy -c, and touch shell commands executed through /bin/sh -c. An authenticated member with compose write and deploy permission can supply a crafted composePath, trigger compose.deploy or startCompose, and execute arbitrary operating-system commands in the Docker-privileged Dokploy host context. This issue is fixed in version 0.29.13.