UpHeron
All vulnerabilities

Servers and applications

GHSA-5cvm-v3wv-2gw3

Authenticated OS command injection in Dokploy leads to root remote code execution (systemic; multiple endpoints)

Severity
Critical 9.9
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
0.31.1
Weakness
OS command injection (CWE-78)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Sources
Project advisories (GitHub)

Description

Dokploy's server engine builds shell command strings by directly interpolating user-controlled fields into template literals and then executes them through a shell — execAsync(cmd) runs /bin/sh -c "" on the Dokploy control-plane host, and execAsyncRemote(serverId, cmd) runs the string via SSH on a managed server whose SSH user is typically root (packages/server/src/utils/process/execAsync.ts). Roughly 336 call sites use these shell sinks; only a handful of fields (appName, branch, databasePassword) are character-restricted, while the rest are free z.string(). As a result, many authenticated API operations allow OS command injection that executes as root.

This was confirmed live with two PoCs: (1) a single destination.testConnection tRPC call injected id and produced uid=0(root) on the Dokploy host (owner/admin-gated); (2) a base-tier organization member — verified UNAUTHORIZED on the destination vector — injected id via volumeBackups.restoreVolumeBackupWithLogs and likewise obtained…

From Dokploy/dokploy's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.31.1

References