UpHeron
All vulnerabilities

Servers and applications

GHSA-h542-rh5v-qgj2

[CWE-78] Authenticated Shell Command Injection via Patch Repository Path in Dokploy

Severity
Critical 9.9
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
0.31.1
Weakness
OS command injection (CWE-78)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Sources
Project advisories (GitHub)

Description

A shell command injection vulnerability exists in Dokploy's patch repository handling functionality.

An authenticated user with access to an application or Docker Compose service can control the repoPath parameter used by the readRepoDirectories API endpoint. This value is later concatenated into a shell command and executed through local or remote command execution functions.

The vulnerability affects Dokploy v0.29.11 (commit: 1c4414165d4aedbf6e28afab7a94c8fb7c053373).

The issue may allow an authenticated attacker to execute arbitrary shell commands on the Dokploy host or configured remote server under the privileges of the corresponding Dokploy execution context.

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The vulnerable data flow consists of three stages: Source, Processing, and Sink.

The repoPath parameter is controlled by the client through the patch repository workflow.

Affected frontend components:

From Dokploy/dokploy's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.31.1

References