Dokploy Command Injection Vulnerability

Dokploy, a free self-hostable Platform as a Service (PaaS), contains a command injection vulnerability in versions prior to 0.29.13.

The patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe argument quoting. An authenticated organization member with service:read permission can inject shell metacharacters into repoPath and execute arbitrary commands through child_process.exec as root in the Dokploy container.

• The supplied service identifier is used only to resolve the server and does not constrain repoPath.
• Because the standard deployment mounts /var/run/docker.sock, container-root command execution can be used to control Docker and compromise the host and its managed applications.
• This issue is fixed in version 0.29.13.