GHSA-j329-jw7j-rxjm

The serviceName field accepted by backup.create and backup.update is interpolated directly into a shell command string without sanitization or escaping. The injected command executes as root inside the Dokploy container at the next scheduled cron tick (default: every minute). Because Dokploy mounts /var/run/docker.sock on standard installations, this leads to full host compromise.

Critically, exploitation requires only a member-level account - no admin or owner privileges are needed. A member with access to a single project can create a backup with an injected serviceName targeting any destination already registered in the organization.

packages/server/src/utils/backups/utils.ts, function getComposeContainerCommand (lines 246–256), interpolates serviceName directly into a shell string:

The backup executes via execAsync(backupCommand, { shell: "/bin/bash" }). The schedule defaults to */1 * * * *, so the payload executes within 60 seconds of creation.