UpHeron
All vulnerabilities

Servers and applications

GHSA-qh9m-682j-9fqr

Authenticated OS command injection in database backup/restore → root RCE (v0.29.8)

Severity
Critical 9.9
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
0.31.1
Weakness
OS command injection (CWE-78)Improper privilege management (CWE-269)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Sources
Project advisories (GitHub)

Description

Authenticated OS command injection in the database backup and restore features, yielding arbitrary command execution as the Dokploy service account (root, for Docker) on the host and on connected remote servers. Present on the latest release (v0.29.8) and is a distinct sink from the 2026 command-injection advisories (appName / containerId / destinationPath / registryUrl / branch / traefik / schedule / container-logs) — the backup/restore command builders were never sanitized.

Disclosure timeline: Reported privately to [email protected] on June 18, follow-up June 19 with full PoC, Discord contact attempt June 28. No response after 12+ days — opening this advisory to establish contact, per GitHub's notification system.

Backup — packages/server/src/utils/backups/utils.ts:

  • getLibsqlBackupCommand (L122): ... tar cf - -C /var/lib/sqld ${database} ... (UNQUOTED)
  • getMariadbBackupCommand (L99): ... --databases ${database} ...
From Dokploy/dokploy's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.31.1

References