EUVD-2026-55740Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable API, low-privilege authenticated account required (traefikFiles.read), no user interaction, full RCE impact on managed servers within Dokploy's administrative domain.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, settings.readTraefikFile in apps/dokploy/server/api/routers/settings.ts passes a path accepted by apiReadTraefikConfig to readConfigInPath in packages/server/src/utils/traefik/application.ts, where configPath is interpolated into execAsyncRemote as cat ${configPath}, allowing a user with traefikFiles.read permission to execute arbitrary commands on a managed server through shell metacharacters. This issue is fixed in version 0.29.13.
AnalysisAI
Command injection in Dokploy's Traefik configuration reader allows authenticated users holding the traefikFiles.read permission to execute arbitrary OS commands on managed servers by supplying file paths containing shell metacharacters. All Dokploy releases prior to 0.29.13 are affected. The impact is full remote code execution on managed infrastructure: complete confidentiality, integrity, and availability loss on any server managed by the Dokploy instance. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis.
Technical ContextAI
Dokploy is a self-hosted, open-source PaaS built on Node.js that uses Traefik as its reverse proxy and load balancer. The vulnerable code path originates in apps/dokploy/server/api/routers/settings.ts at settings.readTraefikFile, which accepts a user-supplied file path via apiReadTraefikConfig. This path is forwarded without sanitization to readConfigInPath in packages/server/src/utils/traefik/application.ts, where it is directly string-interpolated into a shell command: cat ${configPath}. That command string is passed to execAsyncRemote - a function that executes shell commands on remote managed servers - without any escaping or metacharacter neutralization. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) precisely identifies the root cause: the application treats user-controlled input as a safe file path token rather than an untrusted string within a shell context. The CPE cpe:2.3:a:dokploy:dokploy:*:*:*:*:*:*:*:* with wildcard version confirms all releases prior to 0.29.13 are affected. The remediation PR #4873 (commit 92310ddb) reveals the injection pattern was systemic: beyond the Traefik path, equivalent unescaped interpolations were fixed in backup.ts, destination.ts, certificate.ts, and mount.ts, all of which also called execAsyncRemote with user-influenced strings. The fix applies the shell-quote library universally and adds regex-based allowlist validation (VOLUME_NAME_REGEX) for volume name inputs.
RemediationAI
Upgrade Dokploy to version 0.29.13 or later immediately, as documented in security advisory GHSA-j3pv-r5wg-235m and release tag https://github.com/Dokploy/dokploy/releases/tag/v0.29.13. The fix (PR #4873, commit 92310ddb143c8e67ca95eb7db661838a76579f2e) introduces shell-quote escaping across all identified command interpolation sites and adds regex-based input validation for volume names, addressing the systemic injection pattern. If an immediate upgrade is not feasible, the most effective compensating control is to revoke the traefikFiles.read permission from all non-administrative user accounts - this eliminates the attack vector entirely since exploitation is permission-gated, with the trade-off of reducing operational visibility into Traefik configuration for those users. Additionally, restricting network access to the Dokploy management interface to trusted IP ranges or a VPN tunnel will reduce the network-exposed attack surface, though this does not eliminate risk from insider or compromised-account scenarios. Both workarounds should be treated as temporary bridges until the 0.29.13 upgrade is applied.
Dokploy self-hosted PaaS prior to 0.26.6 has a critical command injection vulnerability (CVSS 9.9) allowing authenticate
Dokploy versions before 0.26.6 contain hardcoded database credentials in the installation script, causing nearly all dep
Command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated low-privilege member run arbitrary
Command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated panel user run arbitrary commands o
Remote code execution in Dokploy 0.27.0 through 0.29.2 allows unauthenticated attackers to forge email-verification JWTs
Command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user run arbitrary OS commands on
OS command injection in Dokploy self-hosted PaaS before 0.29.13 lets an authenticated member with service-deployment per
Command injection in Dokploy self-hostable PaaS before 0.29.13 lets an authenticated user with backup:read permission ru
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
OS command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user holding the backup-restor
Cross-tenant remote command execution in Dokploy (self-hosted PaaS) before 0.29.13 lets any authenticated user holding o
Command injection in Dokploy self-hosted PaaS versions prior to 0.29.13 lets an authenticated user with database-service
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today