UpHeron
All vulnerabilities

Servers and applications

GHSA-phrr-h3mm-9vp6

Path Traversal + Command Injection in Patch Application (`generateApplyPatchesCommand`)

Severity
Critical 9.9
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
0.31.1
Weakness
Path traversal (CWE-22)OS command injection (CWE-78)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Sources
Project advisories (GitHub)

Description

The generateApplyPatchesCommand function in Dokploy's patch system embeds the user-controlled filePath field from patch records directly into shell commands within double quotes, without path traversal prevention or shell escaping. This allows an authenticated user who can create patches to achieve arbitrary file write/delete outside the application code directory and Remote Code Execution via shell metacharacters in the filePath. Both attacks execute when the application is deployed.

The patch filePath field is validated only as z.string().min(1) in the schema (packages/server/src/db/schema/patch.ts:56-63):

When patches are applied during deployment, generateApplyPatchesCommand (packages/server/src/services/patch.ts:136-176) builds shell commands by directly embedding the filePath:

This generated command is executed in the application deployment flow (packages/server/src/services/application.ts:217-232):

From Dokploy/dokploy's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.31.1

References