CyberRota Analysis
AI-GeneratedDokploy versions prior to 0.29.8 are vulnerable due to improper handling of user-supplied input in the getRegistryCommands() function, allowing authenticated users with project access to inject malicious commands into the shell. This can lead to arbitrary command execution on the Dokploy server, enabling attackers to read or modify host files and access other containers via Docker. Organizations using Dokploy should prioritize upgrading to version 0.29.8 to mitigate this critical security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.8, the getRegistryCommands() function in packages/server/src/utils/cluster/upload.ts interpolates registry.password and registry.registryUrl directly into a shell command without escaping. An authenticated user with project access can configure malicious registry credentials and trigger a swarm deployment to execute arbitrary OS commands on the Dokploy server, read or modify host files, and access other containers through Docker. This issue is fixed in version 0.29.8.