CyberRota Analysis
AI-GeneratedDokploy versions 0.28.8 and earlier are vulnerable to remote code execution (RCE) due to improper handling of file paths, allowing authenticated users to inject shell metacharacters. This vulnerability can lead to the execution of arbitrary commands on the managed server via SSH, posing a critical risk to system integrity. Organizations using Dokploy should prioritize patching this vulnerability to safeguard their deployments against potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, an authenticated user who can create or update file mounts for a service can inject shell metacharacters into filePath, causing Dokploy to execute attacker-controlled commands on the configured remote managed server over SSH. In the default deployment model, this yields direct remote host RCE from the web interface.