UpHeron
All vulnerabilities

Servers and applications

GHSA-8m32-h7qx-8r79

RCE via Command Injection in Schedule appName

Severity
Critical
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
0.31.1
Weakness
Command injection (CWE-77)
Sources
Project advisories (GitHub)

Description

  • Project: Dokploy
  • Version: v0.29.4
  • Severity: Critical (10.0)
  • Vulnerability Type: Command Injection (CWE-77)

When creating or updating a schedule in Dokploy, the appName can be provided by the user. This appName is used to construct a directory path that is then used in a shell command (mkdir -p) without proper escaping or sanitization. This leads to a Remote Code Execution (RCE) vulnerability.

Full system compromise. An attacker can execute arbitrary commands on the host system with root-level access (as Dokploy usually runs with high privileges to manage Docker).

From Dokploy/dokploy's security advisory.

Affected software

SoftwareAffected versions
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.31.1

References