Dokploy backup feature allows root command injection

OS command injection in Dokploy's database backup/restore functions lets authenticated users execute commands as root; patched in 0.29.13.

CERT/CC published Vulnerability Note VU#280377 describing an OS command injection flaw in Dokploy, an open-source self-hosted PaaS for deploying applications and databases. The backup creation and restoration functionality constructs shell commands using unsanitized user-supplied input—specifically a database name during backup and a backupFile value during restore—which is passed to a shell execution helper invoking /bin/bash. Because the affected tRPC procedures only validate that inputs are non-empty strings, an authenticated user with backup permissions (granted by default for database services) can inject shell metacharacters to achieve arbitrary command execution.

Since the Dokploy process runs with root privileges by default, successful exploitation grants full compromise of the host, including persistent filesystem access and the ability to steal credentials belonging to other tenants on the same instance. All five supported database types—PostgreSQL, MySQL, MariaDB, MongoDB, and LibSQL—are affected. Exploitation was confirmed against Dokploy versions 0.29.8, 0.29.11, and canary commit 24b02f5.

CERT/CC was unable to coordinate disclosure with the vendor, but the issue has been patched in Dokploy 0.29.13 and later. Users unable to update immediately should disable default backup permissions and restrict them to only necessary users and roles to mitigate risk. No in-the-wild exploitation has been reported; this is a vulnerability disclosure requiring proactive patching.

Source reporting: https://kb.cert.org/vuls/id/280377