Dokploy backup feature allows root command injection
OS command injection in Dokploy's database backup/restore functions lets authenticated users execute commands as root; patched in 0.29.13.
Sourcekb.cert.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
CERT/CC published Vulnerability Note VU#280377 describing an OS command injection flaw in Dokploy, an open-source self-hosted PaaS for deploying applications and databases. The backup creation and restoration functionality constructs shell commands using unsanitized user-supplied input—specifically a database name during backup and a backupFile value during restore—which is passed to a shell execution helper invoking /bin/bash. Because the affected tRPC procedures only validate that inputs are non-empty strings, an authenticated user with backup permissions (granted by default for database services) can inject shell metacharacters to achieve arbitrary command execution.
Since the Dokploy process runs with root privileges by default, successful exploitation grants full compromise of the host, including persistent filesystem access and the ability to steal credentials belonging to other tenants on the same instance. All five supported database types—PostgreSQL, MySQL, MariaDB, MongoDB, and LibSQL—are affected. Exploitation was confirmed against Dokploy versions 0.29.8, 0.29.11, and canary commit 24b02f5.
CERT/CC was unable to coordinate disclosure with the vendor, but the issue has been patched in Dokploy 0.29.13 and later. Users unable to update immediately should disable default backup permissions and restrict them to only necessary users and roles to mitigate risk. No in-the-wild exploitation has been reported; this is a vulnerability disclosure requiring proactive patching.
Source reporting: https://kb.cert.org/vuls/id/280377
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs