UpHeron
All vulnerabilities

Servers and applications

GHSA-x2r4-3gv4-jv6x

OS Command Injection via composePath remains in utils/docker/domain.ts - incomplete fix of CVE-2026-72865

Severity
Critical 9.9
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
0.31.1
Weakness
OS command injection (CWE-78)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Sources
Project advisories (GitHub)

Description

The v0.29.13 fix for CVE-2026-72865 (GHSA-8r5w-vqjr-8c44) correctly quoted docker compose -f ${path} in builders/compose.ts and services/compose.ts, but missed two sinks in utils/docker/domain.ts fed by the same user-controlled composePath:

  • writeDomainsToCompose (domain.ts:130): echo "" | base64 -d > "${path}"; - runs on every deploy of a compose that rewrites its file. Command substitution $(...) and backticks execute inside the double-quoted redirect target.
  • loadDockerComposeRemote (domain.ts:88): cat ${path} - completely unquoted, executed over SSH on the remote server.

A member with write+deploy rights on one compose service puts a payload in the Compose Path field in the UI and deploys.

  • composePath: z.string().min(1) only (packages/server/src/db/schema/compose.ts:188), no regex.
  • getComposePath (domain.ts:49-61) uses path.join, which does not neutralize shell metacharacters.
From Dokploy/dokploy's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.31.1

References