Servers and applications
GHSA-2w53-7ppr-3xpp
Incomplete fix of GHSA-p2c7-8j28-c7gq + Missing Authorization in backup/restore (Member -> command execution on managed servers, instance exfiltration and takeover)
- Severity
- Critical 9.9
- Published
- 12 Nov 2026
- Last changed
- 12 Nov 2026
- Added to UpHeron
- 12 Nov 2026
- Fixed in
- 0.31.1
- Attack
- Over the network · Needs a user account · No user action needed
- Attacker can
- Read data · Change data · Take it down
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H- Sources
- Project advisories (GitHub)
Description
The backup endpoints check permissions only when the backup is attached to a service. A backup with databaseType: "web-server" has no service attached, so the checks are skipped and any member can create and run it.
Also, the prefix field is inserted into a shell command without escaping, so $(command) in the prefix executes.
backup.create is only protectedProcedure (routers/backup.ts:83). The permission check at checkServicePermissionAndAccess runs only when a service id (postgresId, mysqlId, etc.) is present. With databaseType: "web-server" there is none, so nothing is checked.
manualBackupWebServer only requires the backup:create permission which members have (backup.ts:459).
The same if (serviceId) guard pattern repeats on backup.one (:173), backup.update (:193) and backup.remove (:250), so a member can also read, modify or delete backups that are not theirs. backup.update is notable: a member can edit an existing backup row (e.g.
Affected software
| Software | Affected versions |
|---|---|
DokployServers and applications · github:dokploy/dokploy |
|
References
- GitHub Advisory Database https://github.com/advisories/GHSA-2w53-7ppr-3xpp
- github.com https://github.com/Dokploy/dokploy/security/advisories/GHSA-2w53-7ppr-3xpp