GHSA-xmmr-fhf3-cwwj

A user with the domain.create permission can execute arbitrary shell commands inside the Dokploy container through the domain.create endpoint. The serviceName parameter is stored without sanitization and later interpolated into a shell command via an error message in the writeDomainsToCompose function, enabling command injection. This results in full container compromise, and if the Docker socket is mounted, the attacker can escape to the underlying host via a privileged container with chroot to the host filesystem.

CRITICAL: Admin and Owner privileges definitely have full, unrestricted access to exploit this vulnerability!

The vulnerability exists in a chain of three functions:

• addDomainToCompose (in packages/server/src/utils/docker/domain.ts) throws an error containing user-controlled serviceName when the service doesn't exist in the compose file.
• writeDomainsToCompose catches this error and interpolates the error message directly into a shell script string.