GHSA-fgh8-p4fg-jc8h

Three injection points in Dokploy's file management, patch repository, and scheduler services combine path traversal (CWE-22) with OS command injection (CWE-78). Two of these (VULN-012, VULN-015) also exploit a drizzle-zod v0.5.1 vulnerability where $defaultFn() fields are exposed as optional in insert schemas, allowing callers to supply arbitrary values.

File: packages/server/src/services/mount.ts Lines: 315–325 (updateFileMount), 336–341 (deleteFileMount) CWE: CWE-22 + CWE-78 | CVSS: 8.5 — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

mount.filePath (z.string().optional(), no regex) is joined with a base path via path.join() and used unquoted in shell commands:

path.join() resolves .. sequences (enabling path traversal) but does NOT remove shell metacharacters.

- filePath = "../../../../etc/cron.d/evil" → arbitrary file write to /etc/cron.d/evil with attacker-controlled content (persistent RCE via cron) - filePath = "../../../../" → rm -rf / → destroys entire server filesystem -…