by Kastro
Paper/Archive/CVE-2026-129433

CVE-2026-129433

Dokploy dokploy — Dokploy before 0.31.1 OS Command Injection via Compose Backup serviceName

CVSS 9.9
critical.is priorityof 100
30
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Dokploy before 0.31.1 contains an OS command injection vulnerability in getComposeContainerCommand() that allows authenticated organization members to execute shell commands via the serviceName parameter. Attackers can store serviceName values with shell metacharacters through backup.create or backup.update tRPC procedures, executing commands as root when scheduled backups run and taking over the host via the mounted Docker socket.

Affected

ProductAffectedFixed inSource
dokploy< 0.31.10.31.1CNA

Scores by source

VulnCheck (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
VulnCheck (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

advisorygithub.com/Dokploy/dokploy/security/advisories/GHSA-j329-jw7j-rxjmpatchgithub.com/Dokploy/dokploy/pull/5908patchgithub.com/Dokploy/dokploy/commit/b24006e16e95a10ce3daf739d06ac783e5c70ba0writeupgithub.com/Dokploy/dokploy/blob/v0.31.0/packages/server/src/utils/backups/utils.ts#L152refgithub.com/Dokploy/dokploy/releases/tag/v0.31.1refgithub.com/Dokploy/dokploywriteupvulncheck.com/advisories/dokploy-before-0.31.1-os-command-injection-via-compose-backup-servicename